Low severity · published Sep 28, 2026
CVE-2026-102363
mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number
3.7
CVSS
0.3%
EPSS
No
On KEV
Description
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mall4j · gz-yami
through 4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102363
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102363
exploit
https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A08_delivery_check_anonymous.py
product
https://github.com/gz-yami/mall4j
technical-description
https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/DeliveryController.java#L47-L63
third-party-advisory
https://www.vulncheck.com/advisories/mall4j-through-4.0-unauthenticated-shipment-tracking-disclosure-via-order-number
More from mall4j
9.1
CVE-2026-102361
mall4j through 4.0 Missing Authentication in Password Update Endpoint
6.5
CVE-2026-102365
mall4j through 4.0 Missing Authorization in Admin User Address Endpoints
5.4
CVE-2026-108691
mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList
5.4
CVE-2026-102367
mall4j through 4.0 Insufficient Session Expiration via Token Refresh
5.4
CVE-2026-102364
mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API