CVE-2026-108691: Operator Precedence Logic Error in gz-yami mall4j

The vulnerability in mall4j through version 4.0 arises from an operator precedence error in the cleanExpiryProdList SQL statement, leading to improper authorization. This flaw allows authenticated users to delete cart items belonging to other shoppers by sending a crafted DELETE request to the /p/shopCart/cleanExpiryProdList endpoint. The affected cart entries correspond to off-shelf products, and once deleted, these items do not return even if the products are restocked.

Exploitation enables authenticated storefront customers to delete other users' cart items for off-shelf products, potentially causing loss of shopping cart data for multiple users. This could disrupt user experience and trust but does not directly lead to system compromise or data leakage beyond cart contents.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /p/shopCart/cleanExpiryProdList endpoint to trusted users only or implement additional authorization checks to prevent unauthorized deletion of other users' cart items.