EUVD-2026-96710
GHSA-8r5r-2mmr-2vjr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as storefront customer
-
ExploitSend DELETE to /p/shopCart/cleanExpiryProdList
-
ImpactOperator-precedence SQL deletes all users' off-shelf cart items
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Operator precedence logic error
|
| Exploitation Conditions | Requires a valid authenticated storefront customer account (CVSS PR:L) on a mall4j instance at version 4.0 or earlier; no admin rights, no user interaction, and no non-default configuration are needed - the vulnerable /p/shopCart/cleanExpiryProdList endpoint is a standard shopping-cart feature. The specific trigger is a DELETE request to that endpoint, which exploits an operator-precedence bug in the cleanExpiryProdList SQL so the WHERE clause fails to scope the deletion to the caller. Limiting factors: attacker must first obtain/create a low-privilege account (authentication barrier), impact is confined to cart entries for off-shelf products, and there is no confidentiality exposure or code execution. |
| Impact | This is a genuine but modest-severity integrity/availability issue, not a high-priority emergency. The input provides a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N, base 5.3 Medium): network-reachable, low complexity, no attack requirements, no user interaction, but requiring low privileges (PR:L) - i.e. any authenticated storefront customer account. Impact is limited to low integrity and low availability (VI:L/VA:L) with no confidentiality impact (VC:N), consistent with cross-user deletion of cart data rather than data theft or code execution. Signals are mostly aligned and point to Medium: a public POC exists (raising practical exploitability), but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of widespread active exploitation. The 'Information Disclosure' tag CONFLICTS with the CVSS vector, which explicitly sets VC:N - this flaw discloses nothing; it destroys/removes other users' cart entries. No SSVC decision data (exploitation/automatable/technical impact) was supplied. Net: a real, trivially-scriptable authenticated authorization bug worth patching, but low business impact (deleted cart items, permanently lost for restocked off-shelf products) and no confidentiality or system-takeover risk - a Medium, not a drop-everything priority. |
| Exploit ScenarioDerived | An attacker registers or uses any ordinary storefront customer account on a mall4j (≤4.0) deployment and sends a single DELETE request to /p/shopCart/cleanExpiryProdList. Due to an operator precedence error in the cleanExpiryProdList SQL statement, the request removes off-shelf-product cart entries for ALL users rather than just the attacker's, and those items do not reappear when products are restocked. A public Python POC (poc_shopcart_clean_expiry_prodlist.py) exists, making the attack trivially repeatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Mall4j through version 4.0 allows any authenticated storefront customer to delete other shoppers' cart entries for off-shelf products by sending a single DELETE request to the /p/shopCart/cleanExpiryProdList endpoint, exploiting an operator precedence error in the cleanExpiryProdList SQL statement that fails to scope the deletion to the caller. This improper authorization flaw (CWE-783) has a CVSS 4.0 score of 5.3 with low integrity and availability impact and no confidentiality impact (PR:L), and publicly available exploit code exists. It is not listed in CISA KEV, and no active exploitation has been confirmed.
RemediationAI
No vendor-released patch identified at time of analysis. To remediate, apply the code-level fix by editing the cleanExpiryProdList SQL statement in yami-shop-service/src/main/resources/mapper/BasketMapper.xml (lines 49-62) to add parentheses around the OR condition and include a user-scoping predicate such as AND user_id = #{userId} in the WHERE clause, then test to ensure deletions are limited to the caller's own cart items. As a temporary workaround, disable the /p/shopCart/cleanExpiryProdList endpoint by removing or commenting the mapping in ShopCartController.java (lines 188-194), though this removes the cart-cleanup feature for off-shelf products and may leave stale cart entries. Alternatively, block DELETE requests to that path at a reverse proxy or WAF, but this may break legitimate use of the feature. Because exploitation requires a valid authenticated account and a public PoC exists, monitor for anomalous mass cart deletions and consider rate-limiting account creation. See the VulnCheck advisory and code references: https://www.vulncheck.com/advisories/mall4j-through-4.0-operator-precedence-error-deletes-other-users-cart-items-via-p-shopcart-cleanexpiryprodlist, https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-service/src/main/resources/mapper/BasketMapper.xml#L49-L62, and https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/ShopCartController.java#L188-L194.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Mall4j is an open-source Java-based e-commerce platform (vendor gz-yami) that uses MyBatis for SQL mapping in its yami-shop-service module. The vulnerability is an operator precedence error (CWE-783) in the cleanExpiryProdList SQL statement defined in BasketMapper.xml (lines 49-62), where missing parentheses cause the WHERE clause to evaluate differently than intended, likely as (condition A AND condition B) OR (condition C) instead of (condition A AND (condition B OR condition C)). As a result, the user-scoping predicate that should restrict deletion to the authenticated user's own cart items is bypassed, allowing any authenticated storefront customer (PR:L) to delete other users' cart entries for off-shelf products via the /p/shopCart/cleanExpiryProdList endpoint exposed by ShopCartController.java (lines 188-194). The CVSS vector indicates no confidentiality impact but low integrity and availability impact, as cart data is deleted and does not return when products are restocked. The CPE cpe:2.3:a:gz-yami:mall4j:*:*:*:*:*:*:*:* identifies all versions up to and including 4.0 as affected.
Know when Mall4J gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network endpoint reachable by any low-privilege customer account (PR:L), so AC:L/UI:N; cross-user cart deletion gives I:L and A:L, no data disclosure (C:N), same authorization scope (S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to /p/shopCart/cleanExpiryProdList to remove every user's cart entries for off-shelf products, which do not return when products are restocked.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB