CVE-2026-111615 Details

A vulnerability exists in Mall4cloud versions through 4.0, specifically within the multishop OrderController. This insecure direct object reference (IDOR) vulnerability allows authenticated merchants to access buyer shipping addresses from other shops. The issue arises in the 'getOrderAddr' handler, where the 'orderAddrId' parameter is not properly scoped to the merchant's own shop. As a result, sellers can enumerate order address IDs through the 'GET /m/order/order_addr/{orderAddrId}' endpoint and retrieve personal information such as consignee names, mobile numbers, addresses, and post codes from across the platform.

The vulnerability can be addressed by adding a check to ensure that the 'orderAddrId' belongs to the caller's shop before returning any address details. This can be implemented by first retrieving the associated order using a tenant-scoped lookup and then verifying the shop ownership.