{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/yshopmall/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:yshopmall:yshopmall:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-110119"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Yshopmall (\u003c= 2.0.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Yshopmall"],"content_html":"\u003cp\u003eYshopmall versions through 2.0.0 contain an Insecure Direct Object Reference (IDOR) vulnerability within the member address API. This flaw arises from insufficient access control checks when processing requests directed at specific address identifiers. An authenticated attacker can exploit this by manipulating the sequential ID parameters used in API endpoints to perform unauthorized actions on behalf of other users. By targeting these endpoints, an attacker can exfiltrate sensitive personal identifiable information (PII), including recipient names, phone numbers, and physical shipping addresses, or perform destructive actions such as deleting or overwriting address entries. Because the identifiers are sequential, an attacker can automate discovery of other users' data, posing a significant risk to user privacy and account integrity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker creates or accesses an existing legitimate account on the target Yshopmall instance.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates to the application and inspects outgoing HTTP traffic to identify the address management API endpoints.\u003c/li\u003e\n\u003cli\u003eThe attacker observes that the API uses sequential integer IDs in parameters for endpoints like /address/detail/{id}.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a series of HTTP GET requests to /address/detail/{id} while incrementing the {id} parameter to enumerate address objects belonging to other users.\u003c/li\u003e\n\u003cli\u003eThe application fails to validate whether the authenticated session user owns the requested address ID.\u003c/li\u003e\n\u003cli\u003eThe application returns the requested recipient names, phone numbers, and physical addresses of other members in the HTTP response.\u003c/li\u003e\n\u003cli\u003eThe attacker repeats this process using POST or DELETE methods on /address/edit and /address/del to modify or remove victim address information.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of this vulnerability results in the unauthorized exposure of PII for the entire customer base of an affected instance. Beyond privacy breaches, the ability to delete or modify shipping addresses can disrupt order fulfillment and lead to financial losses. Given the sequential nature of the address IDs, this vulnerability is highly susceptible to automated scraping, potentially leading to a mass exfiltration event of user data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and restrict access to the Yshopmall address API endpoints if the application cannot be immediately updated.\u003c/li\u003e\n\u003cli\u003eImplement robust object-level authorization checks in the application code to ensure the authenticated user ID matches the ownership of the requested resource ID.\u003c/li\u003e\n\u003cli\u003ePatch Yshopmall to a version containing the fix for CVE-2026-110119 as soon as it becomes available from the vendor.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for anomalous high-frequency access patterns to /address/detail/, /address/del, or /address/edit, especially from authenticated accounts requesting sequential numeric IDs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T18:37:45Z","date_published":"2026-10-13T18:37:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-yshopmall-idor/","summary":"Yshopmall through version 2.0.0 contains an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated members to access, modify, or delete the shipping addresses of other users.","title":"CVE-2026-110119 - Insecure Direct Object Reference in Yshopmall","url":"https://feed.craftedsignal.io/briefs/2026-10-yshopmall-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Yshopmall","version":"https://jsonfeed.org/version/1.1"}