CVE-2026-110119 — yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete othe…
Published: 2026-10-13 · CVSS: 7.1 · CVSS 4.0
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7