CVE-2026-110120: yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated member can exploit it. The attacker needs another member’s after-sales ID and orderCode to target that member’s after-sales data.
What actions can an attacker perform?
An attacker can view another member’s order items through GET /applyForAfterSales/{key}. They can also tamper with logistics information or delete after-sales records using the affected deleteAfterSalesOrder and addLogisticsInformation operations.
Which versions are known to be affected?
Yshopmall through version 2.0.0 is affected. The provided information does not identify a fixed version.