CVE-2026-102363: mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any deployment of mall4j through 4.0 that exposes the DeliveryController checkDelivery endpoint is potentially exposed. No account, authentication, or order ownership is required to retrieve tracking data.
What does an attacker need to exploit it?
An attacker needs an order number to supply to the checkDelivery endpoint. Exploitation is network-based and requires no privileges or user interaction, but the high attack complexity indicates that obtaining or successfully identifying valid order numbers may be difficult.
What information can be disclosed?
The endpoint can disclose the carrier name, waybill number, and complete logistics trail associated with the requested order.
How can I determine whether my instance is affected?
Review whether your mall4j deployment is version 4.0 or earlier and whether the checkDelivery endpoint permits an unauthenticated request with an order number to return shipment tracking details. Also inspect DeliveryController handling for the absence of authentication and order-ownership validation.