CVE-2026-110127: waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints
Published Oct 13, 2026
·Updated
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.
Affected Software
1 affected component
waynboot waynboot-mall<=2.0.0
Event History
Oct 13, 2026
CVE Published
via MITRE·04:53 PM
Data Sourced
via MITRE·04:53 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker needs to be authenticated as a member. No user interaction is required, and the vulnerable mobile cart endpoints are reachable over the network.
2
What actions can an attacker perform against another member's cart?
An attacker can use sequential cart IDs to alter item quantities or selection state, or delete cart items. The affected operations are exposed through PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId}.