CVE-2026-102364: mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API
mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking @PreAuthorize permission checks, including menu listings, file uploads, and configuration endpoints.
Affected Software
Event History
Frequently Asked Questions
Which deployments are within the affected version range?
mall4j versions through 4.0 are affected. Exposure requires a public storefront through which an attacker can obtain a customer session token and reachable admin endpoints that lack @PreAuthorize permission checks.
Does exploitation require an existing back-office account?
No. An attacker can register as a storefront customer, obtain that customer session token, and reuse it against vulnerable admin API endpoints.
What admin functionality may be reachable with a reused customer token?
The reported affected endpoints include menu listings, file uploads, and configuration endpoints when those endpoints lack @PreAuthorize permission checks. The supplied references also indicate missing-permission menu and admin read endpoint cases.