CVE-2026-79406: macrozheng mall quantity OmsCartItemServiceImpl.updateQuantity logic error
A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantity. The manipulation of the argument quantity leads to business logic errors. The attack may be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be initiated remotely, but the CVSS vector indicates that low privileges are required. No user interaction is required.
What security impact is documented?
The documented impact is limited to integrity, meaning an attacker may be able to cause unauthorized changes through the quantity-update logic. No confidentiality or availability impact is indicated.
Which releases are known to be affected?
macrozheng mall versions up to and including 1.0.3 are identified as affected.