CVE-2026-110613: youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the omsorder table using a self-registered account to read order ids, ordersn values, member ids, payment amounts, and order status.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated member account can exploit it, including a self-registered account. No elevated privileges or user interaction are required.
What information can be exposed?
An attacker can page through order records and read order IDs, order serial numbers, member IDs, payment amounts, and order status for every customer.
How can I determine whether my deployment is affected?
Deployments of youlai-mall through commit 9f62de8 are identified as affected. Test the app order list endpoint with a low-privilege member account and verify whether it returns orders belonging to other members.