CVE-2026-110126: waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/{addressId} requests to overwrite or remove victims' saved addresses.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated member can exploit it. The attacker needs a valid account and a target address ID; no user interaction is required.
Are default deployments affected?
The affected endpoints are reachable through the mobile API, so deployments that expose the AddressController functionality to authenticated members are affected. The provided data does not identify any configuration setting that disables the vulnerable behavior.
What can an attacker change or remove?
An attacker can overwrite another member's saved shipping address through POST /address or delete it through DELETE /address/{addressId}. The issue affects integrity and availability of address records, not confidentiality according to the supplied severity vector.
How can we determine whether exploitation may have occurred?
Review requests to POST /address and DELETE /address/{addressId} for cases where the authenticated member does not own the address ID being modified or deleted. Sequential or broadly enumerated address IDs from a single member account are also relevant indicators.
What can be done before patching?
Enforce server-side ownership checks so the authenticated member can only modify or delete address records associated with that member. Restrict or monitor the affected mobile API endpoints and investigate address changes or deletions that lack matching ownership.