CVE-2026-111615: Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint
Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/orderaddr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated merchant account can exploit it. The affected handler does not enforce shop-level ownership when retrieving an order address, so one shop can access buyer shipping data associated with other shops.
What information could be exposed?
Exploitation can disclose buyer consignee names, mobile numbers, shipping addresses, and post codes. The exposed data can be retrieved platform-wide across shops.
Does exploitation require user interaction or complex conditions?
No user interaction is required. An attacker needs a merchant-level authenticated session and can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests.
How can I check whether my deployment is affected?
Review the multishop OrderController getOrderAddr handler and its order-address lookup for ownership or shop-scoping checks. Affected behavior is indicated if an authenticated merchant can request an orderAddrId belonging to another shop and receive the buyer address details.