A vulnerability has been found in macrozheng mall up to 1.0.3. (CVE-2026-82423)

CVE-2026-82423 affects macrozheng mall up to version 1.0.3 in the /order/paySuccess endpoint of the Payment Status component. The vulnerability arises from improper handling of the orderId argument, allowing remote attackers with some privileges to manipulate the behavioral workflow of the application. The vulnerability is categorized under CWE-841 (Improper Enforcement of Behavioral Workflow) and CWE-840 (Business Logic Errors). No official patch or remediation guidance is available, and the vendor deleted the related GitHub issue without explanation. The CVSS v3.1 base score is 5.4, with attack vector network, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

The vulnerability allows remote attackers with low privileges to manipulate the orderId parameter, potentially enforcing unintended behavioral workflows in the payment process. This could lead to integrity and availability impacts, such as unauthorized changes in order payment status or disruption of payment processing. There is no impact on confidentiality. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is available and the vendor has not provided further information, users should monitor for vendor updates and consider implementing additional access controls or validation on the orderId parameter as a temporary measure.