CVE-2026-111615 Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint
Authenticated merchants can enumerate order IDs to access other shops' buyer shipping addresses and personal details.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111615?
CVE-2026-111615 is a high-severity vulnerability in gz-yami mall4cloud, published on 16 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.
Weakness: CWE-639
Which versions are affected by CVE-2026-111615?
How do I fix CVE-2026-111615?
No fix has been published for CVE-2026-111615 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-111615 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111615 exists.
Sources
Also known as GHSA-96x2-4759-fjj4.