High severity · published Oct 13, 2026
CVE-2026-110119
yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YS
yshopmall · guchengwuyue
through 2.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110119
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110119
third-party-advisory
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/yshopmall-member-api-ownership-idor
technical-description
https://github.com/guchengwuyue/yshopmall/blob/d1b20a2d76dfd98985410116db3aca8aca193b26/yshop-mall-boot/yshop-app/src/main/java/co/yixiang/modules/user/rest/UserAddressController.java#L117-L153
technical-description
https://github.com/guchengwuyue/yshopmall/blob/d1b20a2d76dfd98985410116db3aca8aca193b26/yshop-mall-boot/yshop-mall/src/main/java/co/yixiang/modules/user/service/impl/YxUserAddressServiceImpl.java#L75-L114
third-party-advisory
https://www.vulncheck.com/advisories/yshopmall-through-2.0.0-idor-via-member-address-api-in-useraddresscontroller
More from yshopmall
9.8
CVE-2025-15496
guchengwuyue yshopmall jobs getPage sql injection
9.8
CVE-2024-50648
yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files
8.8
CVE-2026-2146
guchengwuyue yshopmall co.yixiang.utils.FileUtil updateAvatar unrestricted upload
7.2
CVE-2025-25426
yshopmall <=v1.9.0 is vulnerable to SQL Injection in the image listing interface
5.4
CVE-2026-110120
yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController