CVE-2026-108691 Details
Description
mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to /p/shopCart/cleanExpiryProdList to remove every user's cart entries for off-shelf products, which do not return when products are restocked.
An improper authorization vulnerability has been identified in mall4j versions through 4.0. This vulnerability allows authenticated storefront customers to delete cart items belonging to other shoppers. The issue arises from an operator precedence error in the 'cleanExpiryProdList' SQL statement. Exploitation involves sending a single DELETE request to '/p/shopCart/cleanExpiryProdList', which removes all users' cart entries for off-shelf products. These items do not return when restocked.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-783 | Operator Precedence Logic Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mall4j | <= 4.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |