CVE-2026-110126 Details

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in Waynboot Mall version 2.0.0. This issue resides within the AddressController of the mobile API, where authenticated users can modify or delete the shipping addresses of other users. The vulnerability arises because the API does not verify ownership of the address being altered or removed. Instead, it relies on auto-incrementing address IDs, which can be easily guessed. Attackers can exploit this by sending POST requests to the /address endpoint or DELETE requests to /address/{addressId}, effectively overwriting or erasing the addresses of other users.

Implement ownership verification in the AddressController to ensure that users can only modify or delete their own addresses. This can be achieved by checking the member ID against the address owner before processing any update or deletion requests.