Insecure Direct Object Reference in Yshopmall Member Address API

CVE-2026-110119

What is CVE-2026-110119?

The Yshopmall platform, specifically version 2.0.0, is affected by an insecure direct object reference vulnerability within its member address API. This flaw permits authenticated users to access, alter, or delete the shipping addresses of other members. By exploiting this vulnerability, attackers can enumerate address IDs through specific API endpoints such as /address/detail/{id}, /address/del, and /address/edit. This leads to unauthorized disclosure of sensitive information including recipient names and phone numbers, as well as manipulation of addresses, putting user privacy at risk.

References