CVE-2026-110613: Authorization Bypass Through User-Controlled Key in youlaitech youlai-mall

The youlai-mall application, up to commit 9f62de8, contains a missing authorization check vulnerability. Authenticated users can exploit this flaw to bypass access controls and retrieve order data belonging to other customers by paging through the oms_order table via the order list API endpoint. This exposure includes sensitive order details, potentially leading to privacy violations and information disclosure.

An attacker with a valid user account can access sensitive order information of all customers, including order IDs, order serial numbers, member IDs, payment amounts, and order statuses. This unauthorized data exposure compromises customer privacy and could facilitate further attacks or fraud. The vulnerability does not require elevated privileges beyond authentication and does not involve user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the order list endpoint to authorized users only and monitor for unusual access patterns. Implement proper authorization checks to ensure users can only access their own order data.