The vulnerability in gz-yami mall4j (<=4.0) involves a missing authentication check on the password update endpoint (PUT /user/updatePwd). An attacker can send a request with a target username and reset that user's password without any verification, enabling full account takeover. This exposes sensitive user information and order data to unauthorized parties. The CVSS 4.0 score is 9.3 (critical), reflecting the high impact and ease of exploitation without privileges or user interaction.

Exploitation allows unauthenticated attackers to reset passwords of any storefront account, resulting in account takeover. Attackers gain unauthorized access to personal data and order information associated with compromised accounts. This can lead to privacy violations, fraud, and further abuse of user accounts.

No patch or official remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and implement additional authentication or monitoring controls to prevent unauthorized password resets.