CVE-2026-79406: Business Logic Errors in macrozheng mall

This vulnerability affects macrozheng mall up to version 1.0.3 in the function OmsCartItemServiceImpl.updateQuantity located in /cart/update/quantity. The flaw arises from improper handling of the quantity argument, resulting in business logic errors. The attack vector is remote with low attack complexity and no privileges required beyond limited privileges. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. There is no known exploit in the wild, and no patch or official remediation guidance has been published. The vendor deleted the GitHub issue related to this vulnerability without explanation.

The impact is limited to business logic errors caused by manipulation of the quantity parameter in the shopping cart update function. This could potentially allow attackers to alter cart quantities in unintended ways, possibly affecting order processing or pricing logic. There is no indication of direct code execution, data disclosure, or privilege escalation from the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available and the vendor has not provided further information, users should monitor vendor channels for updates. Until a fix is released, consider implementing input validation or access controls around the quantity parameter as a temporary mitigation if feasible.