Insecure Direct Object Reference in Yshopmall After-Sales API

CVE-2026-110120

What is CVE-2026-110120?

An insecure direct object reference vulnerability exists within the after-sales API of Yshopmall version 2.0.0. This flaw allows authenticated users to access and manipulate the data of other members by providing their own after-sales IDs and orderCodes. Attackers can exploit this vulnerability to view order items and interfere with or delete other users' after-sales records through specific API calls such as deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key}.

References