EUVD-2026-88579

mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete...

CVE-2026-102363

The mall4j framework (versions through 4.0 ) is vulnerable to an unauthenticated shipment tracking disclosure. The flaw exists in the DeliveryController checkDelivery endpoint, where a missing authentication check allows attackers to retrieve shipment tracking information by providing an order nu...