CVE-2026-111615Published
Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111615 · Microsoft / collected KEV context
cve-program · CVE-2026-111615
- https://hackmd.io/@hieuPenguinnn/mall4cloud-multishop-order-addr-cross-shop-idor
- https://github.com/gz-yami/mall4cloud/blob/v4.0/mall4cloud-order/src/main/java/com/mall4j/cloud/order/controller/multishop/OrderController.java#L75-L80
- https://github.com/gz-yami/mall4cloud/blob/v4.0/mall4cloud-order/src/main/resources/mapper/OrderAddrMapper.xml#L27-L29
- https://www.vulncheck.com/advisories/mall4cloud-through-4.0-idor-exposing-buyer-addresses-via-order-addr-endpoint
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.