BizSpring Shop EUVD-2026-101236

Requires a valid authenticated member account on the storefront (PR:L) and knowledge of another member's orderId, which is user-supplied directly to the OrderController cancel and receive handlers without any ownership/authorization check. Exploitation is limited to the order-lifecycle actions those two handlers expose - cancelling pending orders (releasing allocated stock) and confirming receipt of shipped orders (advancing fulfilment/settlement); it does not grant data disclosure or code execution. Limiting factors: the attacker must obtain valid session credentials and must know or enumerate victim orderId values; impact is confined to order state and bounded by whether target orders are in a cancellable/receivable state. No special non-default configuration is required - the missing authorization check is present in the referenced default code.

This is a medium-severity authorization flaw (CWE-639, IDOR) whose signals are internally consistent and point to a real but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) correctly describes a network-reachable, low-complexity attack requiring low privileges - i.e., any authenticated member account - with no confidentiality impact and only limited integrity and availability impact. No EPSS score was supplied, the CVE is NOT in CISA KEV, and the input flags no proof-of-concept, so there is no evidence of active exploitation or mass automation; a public technical writeup (hackmd) and the exact vulnerable source lines are referenced, which lowers the barrier to developing an exploit but does not itself constitute weaponized code. The practical ceiling is low: an attacker must first hold a valid member account and can only manipulate order lifecycle state (cancel/confirm-receive) by guessing or enumerating other members' orderId values - there is no RCE, data theft, or privilege escalation. Net: a legitimate but non-urgent priority - real because exploitation is trivial for any authenticated user against default behavior, but low-impact and confined to order integrity/availability rather than system compromise. No signals conflict; the chief gap is the absence of EPSS/exploit-maturity data to gauge likelihood of opportunistic use.

An attacker registers or already holds an ordinary member account on a BizSpring Shop / Java Mall storefront, then calls the OrderController cancel or receive endpoint while substituting another member's orderId that they obtained by enumeration or guessing sequential IDs. Because the handlers do not verify that the order belongs to the caller, the attacker cancels a victim's pending order (releasing reserved stock) or marks a shipped order as received (prematurely advancing fulfilment and settlement). No public weaponized exploit is identified, but a technical advisory and the exact vulnerable code lines are published, making exploitation straightforward to reproduce.