CVE-2026-108691

🗓️ 11 Oct 2026 01:12:25Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 17 Views🌐 WEB

Improper authorization in mall4j lets authenticated customers delete other shoppers' cart items.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2026-108691	11 Oct 202601:49	–	circl
Cvelist	CVE-2026-108691 mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList	11 Oct 202601:12	–	cvelist
EUVD	EUVD-2026-96710	11 Oct 202601:12	–	euvd
Mend	CVE-2026-108691	11 Oct 202601:12	–	mend
NVD	CVE-2026-108691	11 Oct 202602:16	–	nvd
osv_cve	CVE-2026-108691 mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList	11 Oct 202601:12	–	osv_cve
Positive Technologies	PT-2026-109985	11 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-108691: Operator Precedence Logic Error	11 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-108691 mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList	11 Oct 202601:12	–	vulnrichment

[
  {
    "vendor": "gz-yami",
    "product": "mall4j",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0",
        "lessThanOrEqual": "4.0",
        "status": "affected",
        "versionType": "custom"
      }
    ],
    "packageURL": "pkg:github/gz-yami/mall4j",
    "repo": "https://github.com/gz-yami/mall4j"
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/mall4j-through-4.0-operator-precedence-error-deletes-other-users-cart-items-via-p-shopcart-cleanexpiryprodlist
github	www.github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/ShopCartController.java
github	www.github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-service/src/main/resources/mapper/BasketMapper.xml
github	www.github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/mall4j/poc_shopcart_clean_expiry_prodlist.py

Parameter	Position	Path	Description	CWE
cleanExpiryProdList	request body	/p/shopCart/cleanExpiryProdList	Improper authorization in the cleanExpiryProdList SQL statement allows authenticated customers to delete other shoppers' cart items for off-shelf products.	CWE-783

16 Oct 2026 19:18Current

5.9Medium risk

Vulners AI Score5.9

CVSS 45.3

CVSS 3.15.4

EPSS0.00238

SSVC

CWE-783