CVE-2026-110120: Yshopmall Authentication Bypass Vulnerability

CVE-2026-110120 Overview

CVE-2026-110120 is an Insecure Direct Object Reference (IDOR) vulnerability in Yshopmall through version 2.0.0. The flaw resides in the after-sales API exposed by StoreAfterSalesController. Authenticated members can access, modify, or delete after-sales records belonging to other members by supplying an arbitrary after-sales id and orderCode. The affected endpoints include deleteAfterSalesOrder, addLogisticsInformation, and GET /applyForAfterSales/{key}. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Any authenticated member can read other members' order items and tamper with or delete their after-sales records, breaking tenant isolation across the storefront.

Affected Products

• Yshopmall through 2.0.0
• StoreAfterSalesController in yshop-mall-boot/yshop-app
• StoreAfterSalesServiceImpl in yshop-mall-boot/yshop-mall

Discovery Timeline

• 2026-10-13 - CVE-2026-110120 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110120

Vulnerability Analysis

Yshopmall is a Java-based e-commerce platform. Its after-sales workflow lets members request returns, submit logistics information, and cancel after-sales tickets. The API handlers in StoreAfterSalesController accept an after-sales id and orderCode from the client and pass them directly to the service layer. The service layer in StoreAfterSalesServiceImpl does not validate that the authenticated member owns the referenced after-sales record. As a result, an attacker who holds any valid member session can operate on another member's records by iterating or guessing identifiers.

Root Cause

The root cause is missing ownership enforcement on object references. The affected methods trust client-supplied id and orderCode values and query records without filtering by the current member's user ID. The access control model relies on the fact that identifiers are not published, which is a form of security through obscurity rather than authorization.

Attack Vector

The vulnerability is reachable over the network and requires only low-privileged authentication as a standard member. An attacker registers or logs into an ordinary account, obtains a session token, then issues requests to:

• GET /applyForAfterSales/{key} to read another member's order items.
• POST to deleteAfterSalesOrder to delete another member's after-sales record.
• POST to addLogisticsInformation to inject or alter logistics data on another member's claim.

See the VulnCheck Advisory on IDOR and the HackMD IDOR Analysis for request-level details. No public exploit tooling is listed in the CVE record.

Detection Methods for CVE-2026-110120

Indicators of Compromise

• Repeated requests to /applyForAfterSales/{key}, deleteAfterSalesOrder, or addLogisticsInformation from a single session enumerating sequential id or orderCode values.
• After-sales records being modified or deleted by a member ID that does not match the record owner in the database.
• Spikes in 4xx/2xx responses on after-sales endpoints that do not correlate with order activity for the calling member.

Detection Strategies

• Add server-side logging that records the authenticated member ID alongside each after-sales id and orderCode processed by StoreAfterSalesController.
• Reconcile these logs against order ownership to flag mismatches as authorization violations.
• Deploy a web application firewall rule or API gateway policy that rate-limits enumeration patterns against /applyForAfterSales/* endpoints.

Monitoring Recommendations

• Alert on any single session invoking after-sales endpoints with more than a handful of distinct orderCode values in a short interval.
• Monitor the database audit trail for UPDATE and DELETE operations on the after-sales table where the actor and record owner differ.
• Track complaints or support tickets referencing missing or altered return requests, which may indicate exploitation.

How to Mitigate CVE-2026-110120

Immediate Actions Required

• Inventory internet-facing Yshopmall deployments and confirm the version in use against the vulnerable range (through 2.0.0).
• Restrict access to the after-sales endpoints at the reverse proxy or API gateway until a code-level fix is applied.
• Add server-side ownership checks that compare the authenticated member ID against the owner of the referenced after-sales record before executing any read, update, or delete.

Patch Information

No vendor patch is referenced in the CVE record at publication. Operators should track the upstream project at guchengwuyue/yshopmall on GitHub for an authorized fix. Review the vulnerable handlers in StoreAfterSalesController and StoreAfterSalesServiceImpl when preparing a local fix.

Workarounds

• Modify StoreAfterSalesServiceImpl so each query filters by both the after-sales id and the current member's user ID derived from the session, rejecting mismatches with HTTP 403.
• Replace sequential numeric identifiers with unguessable UUIDs for after-sales records to raise the cost of enumeration while a permanent fix is prepared.
• Enforce per-member rate limits on after-sales endpoints at the API gateway to slow brute-force identifier discovery.

# Example reverse-proxy rate limit for after-sales endpoints (NGINX)
limit_req_zone $binary_remote_addr zone=aftersales:10m rate=10r/m;

location ~ ^/(applyForAfterSales|deleteAfterSalesOrder|addLogisticsInformation) {
    limit_req zone=aftersales burst=5 nodelay;
    proxy_pass http://yshop_backend;
}