CVE-2026-102365: mall4j through 4.0 Missing Authorization in Admin User Address Endpoints
Published Sep 28, 2026
·Updated
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.
Affected Software
1 affected component
mall4j mall4j<=4.0
Event History
Sep 28, 2026
CVE Published
via MITRE·11:34 PM
Data Sourced
via MITRE·11:34 PM
DescriptionSeverityWeakness
Sep 29, 2026
Data Sourced
via NVD·12:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Is an administrator role required to exploit the issue?
The reported precondition is an authenticated account with low privileges. The available information does not identify an administrator-role requirement.
2
Are unauthenticated users able to retrieve the address data?
No. The CVSS vector specifies PR:L, and the report describes exploitation by authenticated attackers.
3
Is a fixed release identified?
No fixed release is provided in the available data. mall4j versions through 4.0 should be treated as affected.