CVE-2026-109406: Business Logic Errors in macrozheng mall

This vulnerability affects macrozheng mall up to version 1.0.3 in the mall-portal component's order generation service. Specifically, the OmsPortalOrderServiceImpl function improperly handles the coupon_amount and pay_amount parameters, leading to business logic errors. These errors can be triggered remotely, potentially allowing attackers to manipulate order processing logic. The vendor has not provided a patch or advisory, and the original issue was deleted from GitHub without comment.

The vulnerability allows remote attackers to exploit business logic flaws related to order payment and coupon application. This could lead to incorrect order processing, such as unauthorized discounts or payment bypasses, impacting the integrity of transactions. However, there are no known exploits in the wild, and the CVSS score rates the severity as medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and the vendor has not commented publicly, users should monitor for updates from the vendor or community. Until a fix is available, consider restricting access to the affected order generation functionality or implementing additional validation controls on coupon and payment amounts.