CVE-2026-108690: Operator Precedence Logic Error in gz-yami mall4j

CVE-2026-108690 is an information disclosure vulnerability in gz-yami's mall4j product through version 4.0. The flaw arises from an operator precedence error in the SQL filter getShopCartExpiryItems, which allows authenticated users with any storefront account to retrieve off-shelf product basket entries belonging to other shoppers. The exposed data includes product information, SKU, quantity, shop, and promoter card numbers. This vulnerability does not require elevated privileges beyond authentication and does not involve user interaction or complex attack vectors.

An attacker with any authenticated storefront account can access sensitive information from other users' shopping carts, potentially leading to privacy violations and unauthorized data exposure. The disclosed data includes product and promotional details, which could be leveraged for further attacks or fraud. There is no indication of remote code execution or privilege escalation from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint to trusted users only and monitor for suspicious activity involving the /p/shopCart/expiryProdList request. Avoid exposing sensitive cart information through this endpoint.