CVE-2026-110119 - Insecure Direct Object Reference in Yshopmall

Yshopmall versions through 2.0.0 contain an Insecure Direct Object Reference (IDOR) vulnerability within the member address API. This flaw arises from insufficient access control checks when processing requests directed at specific address identifiers. An authenticated attacker can exploit this by manipulating the sequential ID parameters used in API endpoints to perform unauthorized actions on behalf of other users. By targeting these endpoints, an attacker can exfiltrate sensitive personal identifiable information (PII), including recipient names, phone numbers, and physical shipping addresses, or perform destructive actions such as deleting or overwriting address entries. Because the identifiers are sequential, an attacker can automate discovery of other users' data, posing a significant risk to user privacy and account integrity.

Attack Chain

1. The attacker creates or accesses an existing legitimate account on the target Yshopmall instance.
2. The attacker authenticates to the application and inspects outgoing HTTP traffic to identify the address management API endpoints.
3. The attacker observes that the API uses sequential integer IDs in parameters for endpoints like /address/detail/{id}.
4. The attacker crafts a series of HTTP GET requests to /address/detail/{id} while incrementing the {id} parameter to enumerate address objects belonging to other users.
5. The application fails to validate whether the authenticated session user owns the requested address ID.
6. The application returns the requested recipient names, phone numbers, and physical addresses of other members in the HTTP response.
7. The attacker repeats this process using POST or DELETE methods on /address/edit and /address/del to modify or remove victim address information.

Impact

The successful exploitation of this vulnerability results in the unauthorized exposure of PII for the entire customer base of an affected instance. Beyond privacy breaches, the ability to delete or modify shipping addresses can disrupt order fulfillment and lead to financial losses. Given the sequential nature of the address IDs, this vulnerability is highly susceptible to automated scraping, potentially leading to a mass exfiltration event of user data.

Recommendation

Prioritized actions for security teams:

• Identify and restrict access to the Yshopmall address API endpoints if the application cannot be immediately updated.
• Implement robust object-level authorization checks in the application code to ensure the authenticated user ID matches the ownership of the requested resource ID.
• Patch Yshopmall to a version containing the fix for CVE-2026-110119 as soon as it becomes available from the vendor.
• Monitor web server logs for anomalous high-frequency access patterns to /address/detail/, /address/del, or /address/edit, especially from authenticated accounts requesting sequential numeric IDs.