MEDIUM 5.3 NVD
CVE-2026-110127
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.
References
- https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-common/src/main/java/com/way
- https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com
- https://github.com/wayn111/waynboot-mall/releases/tag/v2.0.0
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/waynboot-mall-mobile-member-ownership-idor
- https://www.vulncheck.com/advisories/waynboot-mall-through-2.0.0-idor-via-mobile-cart-endp
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-13 via NVD.
vulnfeed aggregates 13242 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.