CVE-2026-110119: yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must be authenticated as a member. No user interaction is required, and the attack can be performed remotely over the network.
What information and actions are exposed?
An attacker can access other members' recipient names, phone numbers, and shipping addresses. They can also overwrite address records, reassign them, or delete them.
Which API operations are involved?
The affected operations are the address detail, deletion, and edit endpoints: /address/detail/{id}, /address/del, and /address/edit. Sequential address IDs can be enumerated to target other members' records.