EUVD-2026-98890
GHSA-53hm-jm56-fv83
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as mall member
-
ExploitEnumerate sequential order IDs/serials
-
ExecutionSubmit victim order ID to order endpoints
-
ImpactRead PII or cancel/delete/refund orders
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated Waynboot-mall member account (PR:L); exploitation is performed against the mobile order endpoints exposed by OrderController (detail, cancel, confirm, delete, refund), which fail to verify that the requested order belongs to the calling member. The attacker simply supplies another member's order id or serial number, and because these identifiers are sequential/enumerable the attack is easily automated. The only limiting factor is the need for any registered member account - no special or non-default configuration, no elevated privileges, and no user interaction are required; default deployments are affected. |
| Impact | This is a medium-severity IDOR (CWE-639) carrying a CVSS 4.0 base score of 5.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N and limited impact (VC:L/VI:L/VA:L). The network-facing, low-complexity, no-interaction profile makes exploitation technically trivial, but PR:L means a valid authenticated mall-member account is required, which meaningfully narrows the attacker population to registered users rather than anonymous internet attackers. No EPSS probability was provided in the input, there is no CISA KEV listing, and no public exploit code is identified - so the real-world exploitation signal is absent/unknown rather than elevated. SSVC decision data (exploitation, automatable, technical impact) was not supplied and cannot be assessed. On balance this is a genuine but moderate-priority flaw: the enumerable sequential IDs make automation easy and the PII exposure (recipient addresses, phone numbers) is a privacy concern, yet the capped L/L/L impacts and the authentication requirement keep it below critical. Because this affects a small-footprint open-source project, broad opportunistic exploitation is unlikely; treat as a prompt patch/mitigation item rather than an emergency. |
| Exploit ScenarioDerived | An attacker registers an ordinary mall-member account, then iterates sequential order IDs or serial numbers against the mobile order API endpoints (detail/cancel/confirm/delete/refund) to read other customers' recipient addresses and phone numbers and to cancel, delete, or refund their orders. No public exploit code is identified, but with AV:N/AC:L/UI:N the IDOR is trivially reproducible by any authenticated user once a single valid ID pattern is observed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Authenticated Waynboot-mall members can read, modify, or cancel other users' orders through the mobile order API (detail, cancel, confirm, delete, and refund endpoints) by supplying another member's order ID or serial number. Because order identifiers are sequential and enumerable, an attacker only needs any registered member account to automate retrieval of other members' shipping addresses and phone numbers or to disrupt their orders. The flaw is present through release 2.0.0; no public exploit code identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis. The permanent fix is a code change: every mobile order endpoint (detail, cancel, confirm, delete, refund) must verify server-side that the authenticated member's ID equals the order's owning member ID before returning or mutating data, ideally by adding a member-scoped query such as WHERE order_id = ? AND member_id = ? or an explicit authorization check in MobileOrderServiceImpl. Until a patched release exists, operators should: (1) replace sequential order identifiers with unguessable values (e.g., UUIDv4) - trade-off: schema and API change potentially breaking existing clients; (2) disable or restrict refund/delete/cancel/confirm self-service endpoints to admin-only roles - trade-off: removes legitimate customer self-service features; (3) add a secondary authorization step such as requiring the order's registered phone number for sensitive operations - trade-off: extra friction for legitimate users; (4) implement rate limiting and monitoring on the mobile order endpoints to detect one account requesting many distinct order IDs, which blunts automated enumeration but may generate false positives; and (5) deploy WAF rules in front of the mobile API to flag suspicious sequential ID access, understanding WAF coverage is imperfect and bypassable. Monitor the GitHub repository at https://github.com/wayn111/waynboot-mall and the VulnCheck advisory for a future patched release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Waynboot-mall is a Java Spring Boot-based e-commerce platform with a mobile member API. The mobile order controller (waynboot-mobile-api/src/main/java/com/wayn/mobile/api/controller/OrderController.java, lines 41-128) maps HTTP requests for order detail, cancel, confirm, delete, and refund to service methods in MobileOrderServiceImpl (waynboot-common/src/main/java/com/wayn/common/core/service/shop/impl/MobileOrderServiceImpl.java, lines 372-473). Those service methods load orders directly by the client-supplied order ID or serial number and never verify that the order's owning member matches the authenticated principal, which is the classic CWE-639 Authorization Bypass Through User-Controlled Key pattern (IDOR). Since order IDs are sequential, an authenticated member can traverse the numeric space to harvest shipping addresses and phone numbers across the customer base, or invoke state-changing endpoints (cancel/delete/refund/confirm) to disrupt other members' orders. The public tag 'Authentication Bypass' is imprecise; the root cause is missing object-level authorization after authentication, not a bypass of login itself. The v2.0.0 release notes describe a backend refactor, apifox integration, payment strategy-pattern rewrite, and message-module consolidation, but do not mention a fix for this ownership-check gap.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Authenticated member required so PR:L; network API with low complexity and no UI; IDOR exposes other members' order PII (C:L) and permits order tampering/disruption (I:L/A:L), scope unchanged.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm, delete and refund endpoints to read recipient addresses and phone numbers or disrupt orders.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB