Insecure Direct Object Reference in Waynboot-Mall Mobile CartController
CVE-2026-110127

5.3MEDIUM

Key Information:

Vendor

Wayn111

Status
Waynboot-mall
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110127?

The mobile application of Waynboot-Mall versions up to 2.0.0 contains an insecure direct object reference vulnerability in the CartController. This flaw enables authenticated users to manipulate and potentially delete the cart items of other members. Attackers can exploit this by sequentially enumerating cart IDs through various HTTP methods such as PUT, POST, and DELETE on the cart endpoints. This vulnerability poses a significant risk as it allows unauthorized modification of user cart contents, compromising user data integrity.

Affected Version(s)

waynboot-mall 0 <= 2.0.0

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/waynboot-mall-m...
third-party-advisory
https://github.com/wayn111/waynboot-mall/blob/v2.0.0/wayn...
technical-description
https://github.com/wayn111/waynboot-mall/blob/v2.0.0/wayn...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.