The vulnerability in mall4j through version 4.0 involves failure to validate the sysType field within sa-token sessions. This improper authentication flaw permits attackers who register as storefront customers to reuse their session tokens to access back-office administrative functions. The affected admin endpoints do not enforce @PreAuthorize permission checks, allowing unauthorized actions such as viewing menu listings, uploading files, and modifying configurations.

Attackers can escalate privileges from a storefront customer to a back-office user by reusing session tokens, potentially gaining unauthorized access to sensitive administrative functions. This could lead to unauthorized data exposure, configuration changes, or other administrative actions. However, the vulnerability requires the attacker to have a valid storefront customer session and targets endpoints lacking proper authorization checks.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and enforce proper authorization checks (@PreAuthorize) on all admin endpoints and validate the sysType field in session tokens to prevent token reuse across user roles.