CVE-2026-102365 — mall4j through 4.0 Missing Authorization in Admin User Address Endpoints
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/…
Published: 2026-09-28 · CVSS: 7.1 · CVSS 4.0
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7