CVE-2026-110120 Details

An insecure direct object reference vulnerability has been identified in the Yshopmall application, specifically in versions through 2.0.0. This vulnerability resides within the after-sales API, allowing authenticated users to access data belonging to other users by providing a victim's after-sales ID and order code. Exploitation of this vulnerability enables attackers to invoke the 'deleteAfterSalesOrder' and 'addLogisticsInformation' functions, or to use the 'GET /applyForAfterSales/{key}' endpoint to retrieve information about other users' orders and manipulate or erase their after-sales records.

The vulnerability can be addressed by implementing object-level ownership checks on the after-sales API endpoints. This involves verifying that the authenticated user is the owner of the after-sales record or order before allowing any actions to be performed.