CVE-2026-110127 Details

A vulnerability allowing insecure direct object reference (IDOR) has been identified in the Waynboot Mall application, specifically in versions through 2.0.0. This vulnerability resides within the mobile CartController, where authenticated users can alter or remove cart items belonging to other users. The issue arises because the API endpoints responsible for managing cart items do not verify ownership, allowing for unauthorized modifications. Attackers can exploit this by sequentially enumerating cart IDs through specific API methods to change item quantities, selection states, or delete items altogether.

To address this vulnerability, implement object-level ownership checks on all mobile member endpoints that manage resources. Ensure that the authenticated member ID is compared to the resource owner ID before allowing any modifications or deletions. This can be achieved by updating the relevant service methods to include these checks and scoping write operations by both the resource ID and the member ID.