CVE-2026-110120 — yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supp…
Published: 2026-10-13 · CVSS: 5.3 · CVSS 4.0
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7