Insecure Direct Object Reference Vulnerability in Waynboot-mall by Wayn Technology

CVE-2026-110125

What is CVE-2026-110125?

The Waynboot-mall application, specifically version 2.0.0, is vulnerable to an insecure direct object reference (IDOR) issue. This vulnerability allows authenticated users to access and modify orders belonging to other members by manipulating order identifiers. Attackers can exploit this flaw by enumerating sequential order IDs through various endpoints such as detail, cancel, confirm, delete, and refund, potentially exposing sensitive information like recipient addresses and phone numbers or disrupting order processes.

References