Threats affecting pkg:github/mall4j

mall4j versions up to 4.0 have an improper authorization vulnerability due to an operator precedence logic error in the cleanExpiryProdList SQL statement. Authenticated storefront customers can exploit this flaw by sending a DELETE request to /p/shopCart/cleanExpiryProdList, which deletes cart items of other users for off-shelf products. These deleted items do not return when products are restocked. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3.

mall4j versions up to 4.0 contain an information disclosure vulnerability due to an operator precedence logic error in the getShopCartExpiryItems SQL filter. Authenticated users can exploit this flaw to access other shoppers' cart items, including product details, SKU, quantity, shop, and promoter card numbers. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3.

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers when accessed from the local storage path, resulting in stored cross-site scripting.

CVE-2026-102365 is a high-severity vulnerability in gz-yami mall4j up to version 4.0 where authorization checks are missing on certain GET endpoints in the UserAddrController. Authenticated attackers can access endpoints that expose customer address data, including names, phone numbers, and postal information. This allows unauthorized data harvesting of sensitive customer information.

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking @PreAuthorize permission checks, including menu listings, file uploads, and configuration endpoints.

mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks.

CVE-2026-102361 is a critical vulnerability in gz-yami mall4j versions up to 4.0 that allows unauthenticated attackers to reset any storefront account password via the PUT /user/updatePwd endpoint. This missing authentication flaw enables attackers to specify a target username and overwrite passwords without verification, leading to account takeover and unauthorized access to orders and personal data.