CVE-2026-110125 Details

A vulnerability allowing insecure direct object reference (IDOR) has been identified in Waynboot-Mall versions through 2.0.0. This vulnerability enables authenticated users to access and modify orders belonging to other users by manipulating order identifiers. The issue arises from the absence of proper ownership checks in the mobile API's order management endpoints. Attackers can exploit this vulnerability by enumerating order IDs or serial numbers through various order-related endpoints, such as detail, cancel, confirm, delete, and refund. This exploitation allows them to access sensitive information, including recipient addresses and phone numbers, or disrupt the order management process.

To address this vulnerability, implement object-level ownership checks on all mobile member endpoints that handle resource IDs. Compare the authenticated member ID to the resource owner's ID for read operations and scope write operations by both the resource ID and the member ID. This pattern should be applied consistently across all relevant endpoints, including order, address, and cart management.