CVE-2025-15086: youlaitech youlai-mall MemberController.java getMemberByMobile access control
A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. This manipulation causes improper access controls. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15086?
CVE-2025-15086 has been classified as a medium severity vulnerability due to improper access controls.
How do I fix CVE-2025-15086?
To fix CVE-2025-15086, update to the latest version of the youlai-mall software that resolves this access control issue.
What versions are affected by CVE-2025-15086?
CVE-2025-15086 affects youlaitech youlai-mall versions 1.0.0 to 2.0.0 inclusive.
What type of vulnerability is CVE-2025-15086?
CVE-2025-15086 is a weakness related to improper access controls in the member retrieval function.
Can CVE-2025-15086 be exploited remotely?
Yes, CVE-2025-15086 can potentially be exploited remotely due to its impact on access controls.