CVE-2026-110613 Details

A missing authorization vulnerability has been identified in Youlai Mall, specifically in the order management service. This vulnerability allows authenticated users to access and view all customer orders through the mobile application order list endpoint. The issue arises because the order retrieval function lacks proper authorization checks, enabling users to paginate through the entire order database using their own accounts. The exposed order details include order IDs, order numbers, member IDs, payment amounts, and order statuses.

To address this vulnerability, implement authorization checks in the order retrieval controller to ensure that users can only access their own orders. This can be done by adding a member ID filter to the order query and updating the corresponding SQL mapper to include this restriction.