youlai-mall EUVD-2026-101241

Requires a valid but low-privilege authenticated member account (PR:L), which an attacker can obtain through youlai-mall's own self-registration - no victim interaction and no admin or pre-existing authorization are needed. The specific trigger is the app order-list endpoint in OrderController whose underlying OmsOrderMapper query lacks a member-id ownership filter, letting any member page the full oms_order table. Limiting factors: an account must be registered and authenticated first (so it is not fully unauthenticated), exposure is read-only order metadata (ids, order_sn, member ids, payment amounts, status) with no integrity/availability impact and no card/credential data noted, and the instance must be running the affected codebase at/around commit 9f62de8 with the app endpoint reachable.

Signals are moderate and largely consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (7.1, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) describes a network-reachable, low-complexity information-disclosure flaw requiring only low privileges, and VC:H with VI:N/VA:N correctly reflects a read-only mass-disclosure issue with no integrity or availability impact. CWE-639 (authorization bypass through user-controlled key) matches the description precisely. No EPSS score, no CISA KEV entry, and no exploit code were provided, so there is no evidence of active exploitation - this is not a drop-everything emergency on exploitation-probability grounds. However, exploitability is practically trivial: the PR:L requirement is satisfied by any self-registered account, and a detailed public technical writeup (hackmd) plus a VulnCheck advisory pinpoint the exact vulnerable source lines (OrderController.java and OmsOrderMapper.xml), substantially lowering the bar to reproduce even absent packaged exploit code. The dominant risk-limiting factor is deployment footprint: youlai-mall is a niche open-source e-commerce/learning project, so real-world blast radius is small. Net: a genuine, easily-exploited authorization flaw of moderate severity whose priority is capped mainly by the low prevalence of the affected product rather than by any missing or contradictory technical signal.

An attacker self-registers an ordinary member account on a youlai-mall instance, authenticates, and calls the app order-list endpoint, which fails to scope results to the caller's own member id. By iterating the paging parameters they enumerate the entire oms_order table, harvesting other customers' order ids, order_sn values, member ids, payment amounts, and order status. No packaged exploit code is published, but a public writeup documents the exact vulnerable controller and mapper, so reproduction is straightforward.