Low severity · published Aug 9, 2026
CVE-2026-19361
macrozheng mall mall-portal getAuthCode password recovery
3.7
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high complexity. It is stated that the exploitability is difficult. The exploit has been published and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mall · macrozheng
0504e86 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19361
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19361
github.com
https://github.com/macrozheng/mall/
github.com
https://github.com/macrozheng/mall/issues/979
github.com
https://github.com/wr0ld/macrozheng-mall-Commit-0504e86-Broken-Authentication/issues/1
vuldb.com
https://vuldb.com/cve/CVE-2026-19361
vuldb.com
https://vuldb.com/submit/866081
vuldb.com
https://vuldb.com/vuln/387215
More from mall
9.1
CVE-2026-25858
macrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP Disclosure
8.1
CVE-2024-11619
A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3
6.5
CVE-2026-108784
macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error
6.5
CVE-2025-13443
macrozheng mall delete access control
6.3
CVE-2026-108785
macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration