CVE-2026-110119 Details

An insecure direct object reference vulnerability has been identified in the Yshopmall application, specifically in version 2.0.0. This vulnerability resides within the member address API, allowing authenticated users to read, overwrite, and delete the shipping addresses of other members. The issue arises because the API endpoints do not verify ownership of the address IDs being accessed or modified. Attackers can exploit this by enumerating address IDs through the detail, delete, and edit endpoints, thereby exposing sensitive information such as recipient names, phone numbers, and addresses. Furthermore, they can manipulate this data by reassigning addresses or deleting them entirely.

The vulnerability can be addressed by implementing object-level ownership checks on all member API endpoints that handle resource IDs. This includes verifying that the authenticated user owns the address or after-sales record before allowing any read, edit, or delete operations. The Yshopmall development team has been made aware of this vulnerability and has provided a recommended fix.