CVE-2026-109410: macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculation

Published Oct 13, 2026

Updated

A vulnerability has been found in macrozheng mall 1.0.3 dcaa93b. The impacted element is the function OmsOrderServiceImpl.updateMoneyInfo of the file /order/update/moneyInfo of the component mall-admin/mall-portal. The manipulation leads to incorrect calculation. The attack can be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

Affected Software

1 affected component

macrozheng mall=1.0.3

Event History

Oct 13, 2026

CVE Published

via MITRE·01:30 PM

Data Sourced

via MITRE·01:30 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must have high privileges and be able to interact with the affected functionality. The attack can be initiated remotely, but user interaction is also required.

Which component and function should be reviewed?

Review the mall-admin and mall-portal components, specifically the /order/update/moneyInfo functionality and the OmsOrderServiceImpl.updateMoneyInfo function.

What is the known impact?

The reported impact is incorrect calculation with integrity impact rated low. No confidentiality or availability impact is identified in the provided data.

How can I determine whether my deployment is affected?

Check whether your deployment uses macrozheng mall version 1.0.3 at revision dcaa93b and exposes the affected order money-information update functionality.