CVE-2026-102363 — mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracki…
Published: 2026-09-28 · CVSS: 6.3 · CVSS 4.0
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7