Medium severity · published Oct 13, 2026
CVE-2026-110120
yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YS
yshopmall · guchengwuyue
through 2.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110120
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110120
third-party-advisory
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/yshopmall-member-api-ownership-idor
technical-description
https://github.com/guchengwuyue/yshopmall/blob/d1b20a2d76dfd98985410116db3aca8aca193b26/yshop-mall-boot/yshop-app/src/main/java/co/yixiang/sales/rest/StoreAfterSalesController.java#L151-L187
technical-description
https://github.com/guchengwuyue/yshopmall/blob/d1b20a2d76dfd98985410116db3aca8aca193b26/yshop-mall-boot/yshop-mall/src/main/java/co/yixiang/modules/sales/service/impl/StoreAfterSalesServiceImpl.java#L353-L383
third-party-advisory
https://www.vulncheck.com/advisories/yshopmall-through-2.0.0-idor-via-after-sales-api-in-storeaftersalescontroller
More from yshopmall
9.8
CVE-2025-15496
guchengwuyue yshopmall jobs getPage sql injection
9.8
CVE-2024-50648
yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files
8.8
CVE-2026-2146
guchengwuyue yshopmall co.yixiang.utils.FileUtil updateAvatar unrestricted upload
7.2
CVE-2025-25426
yshopmall <=v1.9.0 is vulnerable to SQL Injection in the image listing interface
7.1
CVE-2026-110119
yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController