waynboot-mall EUVD-2026-98892

Requires a valid authenticated shop member account (CVSS PR:L) and that the mobile cart API (PUT /cart, POST /cart/changeNum, DELETE /cart/{cartId}) exposes server-side cart records keyed by sequential, predictable cartId values without an ownership check tying the record to the requesting member - the described default behavior of waynboot-mall through 2.0.0. No special non-default configuration or user interaction is needed. Exploitation is limited by: the need for member-level authentication, the predictability/enumerability of cart IDs, and the fact that impact is confined to other members' cart items (integrity only) - no confidentiality exposure, account compromise, or service availability impact.

This is a genuine but low-to-moderate priority issue. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable, low-complexity exploitation, but PR:L means a valid authenticated member account is required, which limits the attacker pool to registered users of the shop. The only impact metric set is VI:L (low integrity); confidentiality (VC:N) and availability (VA:N) are explicitly none, and scope is unchanged - so an attacker can tamper with other members' cart contents (quantities, selection state, item removal) but cannot read their data, take over accounts, or deny service to the platform. No EPSS score, no CISA KEV listing, and no confirmed public exploit code are present in the input, so there is no evidence of active exploitation or automatable mass-abuse; the SSVC technical impact is partial at best. The CWE-639 (IDOR/authorization bypass) classification is consistent with the description, but note the input Tag 'Authentication Bypass' conflicts with this - the flaw is an authorization (object-ownership) bypass by an already-authenticated user, NOT an authentication bypass, so the tag is misleading. Overall this reads as a legitimately-rated medium (5.3) integrity bug whose real-world risk is capped by the authentication requirement and the low-value, non-sensitive nature of cart data.

An authenticated member of the waynboot-mall shop observes that their own cart item is referenced by a small integer ID, then iterates nearby sequential IDs belonging to other members. Using the mobile API endpoints PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId}, they alter quantities and selection flags or delete items from victims' carts without owning those records. No public exploit code is identified in the provided data, though a HackMD write-up and a VulnCheck advisory document the methodology.