EUVD-2026-68092
GHSA-v5wh-356j-jg3c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authenticated mall user account
-
ExploitIssue concurrent POST requests to /order/submit
-
ExecutionRace server-side order state commit
-
ImpactExploit unsynchronized check to duplicate order or bypass policy
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated session on the target macrozheng mall instance - the CVSS 4.0 vector specifies PR:L (low privileges), meaning a standard registered user account suffices and no administrative access is needed. The vulnerability is further constrained by high attack complexity (AC:H), indicating that successful timing of the race window is non-trivial and likely requires multiple attempts or tooling. The flaw is specific to the /order/submit endpoint; deployments that disable or restrict order submission (e.g., staging instances without active purchasing) are not exploitable. No non-default configuration is described as required beyond the order submission feature being active and network-accessible. |
| Impact | The CVSS 4.0 base score of 2.3 reflects genuinely low risk: high attack complexity (AC:H) and low-privilege requirement (PR:L) together present a difficult exploitation bar, and the impact metrics show no confidentiality breach with only low integrity and availability effects. No EPSS data was supplied in the input, KEV status does not apply (vulnerability is not in CISA KEV), and no public exploit code exists at time of analysis. The vendor deletion of the GitHub issue without explanation is a transparency concern but does not technically elevate severity - it does, however, hinder defenders' ability to confirm scope or obtain guidance. Overall, this is a low-priority issue that warrants remediation but should not displace higher-severity work. |
| Exploit ScenarioDerived | An authenticated attacker sends multiple simultaneous POST requests to /order/submit before the server commits order state, potentially duplicating an order or bypassing coupon or inventory checks before they complete. Successful exploitation requires precise request timing, making this difficult to execute reliably. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 29, 2026
Race condition in macrozheng mall's /order/submit endpoint (versions up to 1.0.3) allows authenticated remote attackers to exploit unsynchronized order state through concurrent HTTP request timing. The CVSS 4.0 vector (AV:N/AC:H/PR:L) confirms network reachability but high attack complexity and a required authenticated session, yielding limited integrity and availability impact. No public exploit code has been identified and the vendor deleted the associated GitHub issue without explanation, reducing transparency around scope and remediation.
RemediationAI
No vendor-released patch version has been confirmed - the associated GitHub issue (https://github.com/macrozheng/mall/issues/983) was deleted by the vendor without explanation and no advisory with a fix version is available. As a compensating control, implementers should add server-side idempotency enforcement on /order/submit (e.g., reject duplicate request tokens within a short window), which prevents concurrent submissions from racing without requiring application logic changes. Database-level row locking or optimistic concurrency control on order records can close the race window at the persistence layer, though this may introduce latency under high order volume. Rate-limiting authenticated users on the order submission endpoint provides an additional barrier at the cost of potential friction for legitimate users. Monitor https://vuldb.com/vuln/396780 for patch availability updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
macrozheng mall is an open-source Java-based e-commerce platform hosted at github.com/macrozheng/mall. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) identifies the root cause as a failure to atomically lock or sequence shared order state during concurrent HTTP submissions to the /order/submit endpoint. In e-commerce systems, this class of flaw commonly manifests as a time-of-check/time-of-use (TOCTOU) defect - for example, concurrent order submissions racing before inventory counts, coupon validity, or account balance checks are committed, enabling duplicate orders or policy bypass. The affected version range is up to 1.0.3 per VulDB reporting.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable endpoint requiring authenticated session and precise timing; no confidentiality impact, only minor integrity and availability effects from order state manipulation.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /order/submit of the component Order Submission. The manipulation leads to race condition. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The vendor deleted the GitHub issue for this vulnerability without and explanation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Exploit-DB