CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API
Attackers can reuse storefront session tokens to access admin endpoints, enabling privilege escalation and unauthorized data access in mall4j.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-102364?
CVE-2026-102364 is a medium-severity authentication bypass vulnerability in gz-yami mall4j, published on 28 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking @PreAuthorize permission checks, including menu listings, file uploads, and configuration endpoints.
Weakness: CWE-287
Which versions are affected by CVE-2026-102364?
How do I fix CVE-2026-102364?
No fix has been published for CVE-2026-102364 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-102364 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-102364 exists.
Sources
Also known as GHSA-7f4q-fvgh-44w4.