CVE-2026-4563 Details
Description
A weakness has been identified in MacCMS up to 2025.1000.4052. This vulnerability affects the function order_info of the file application/index/controller/User.php of the component Member Order Detail Interface. This manipulation of the argument order_id causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
An authorization bypass vulnerability has been identified in MacCMS versions through 2025.1000.4052. The issue resides in the order detail API within the member center, specifically in the 'order_info' function of 'application/index/controller/User.php'. This vulnerability allows authenticated users to access other users' order details by manipulating the 'order_id' parameter. The API fails to verify ownership, enabling access to sensitive information such as order codes, prices, remarks, and user identifiers.
It is recommended to add ownership checks in the 'order_info' query to ensure that users can only access their own orders. Additionally, object-level authorization checks should be applied to all member APIs that retrieve resources by primary key.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 23, 2026CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HuajiHD/CVE/issues/10 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/?ctiid.352400 | [email protected] | Content Wall |
| https://vuldb.com/?id.352400 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/?submit.775050 | [email protected] | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MacCMS | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Mar 23, 2026 | New CVE Received | [email protected] |