Threats Tagged 'ghsa-q842-qqjh-38pv'

CVE-2026-102365 is a high-severity vulnerability in gz-yami mall4j up to version 4.0 where authorization checks are missing on certain GET endpoints in the UserAddrController. Authenticated attackers can access endpoints that expose customer address data, including names, phone numbers, and postal information. This allows unauthorized data harvesting of sensitive customer information.