CVE-2026-102361 — mall4j through 4.0 Missing Authentication in Password Update Endpoint
mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account pass…
Published: 2026-09-28 · CVSS: 9.3 · CVSS 4.0
mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7