CVE-2026-110125: waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints
Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm, delete and refund endpoints to read recipient addresses and phone numbers or disrupt orders.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated member can exploit it. The attacker needs a valid order identifier, which may be enumerated when order IDs or serial numbers are sequential.
What information and actions are exposed?
An attacker can access other members' order details, including recipient addresses and phone numbers. They can also cancel, confirm, delete, or refund orders belonging to other members through the affected mobile order endpoints.
Are unauthenticated internet users affected?
The described attack requires authentication as a member, so an unauthenticated user is not described as able to exploit it directly. Any account with member-level access should be treated as capable of targeting other members' orders.
How can teams determine whether they are affected?
Systems running waynboot-mall through 2.0.0 should review mobile order detail, cancel, confirm, delete, and refund requests for authorization checks that verify the requested order belongs to the authenticated member. Test using one member account against an order identifier owned by a different member.