CVE-2026-110608: BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive
BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated member account can exploit it. The attacker must be able to supply the orderId of another member's order; no additional user interaction is required.
Which order actions can an attacker perform on another member's order?
An attacker can cancel a victim's pending order, which can release allocated stock, or confirm receipt for a shipped order. Confirming receipt can advance fulfilment and settlement without the victim's consent.
Are unauthenticated users affected?
The described attack requires an authenticated member account. The available information does not establish exploitation by unauthenticated users.
How can teams identify potential exploitation?
Review order cancellation and receipt-confirmation activity for cases where the authenticated member does not match the owner of the orderId being acted upon. Investigate unexpected cancellations of pending orders and receipt confirmations for shipped orders.