CVE-2026-111615

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET...

CVE-2026-111615

The Mall4cloud platform (versions through 4.0 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the multishop OrderController getOrderAddr handler. This vulnerability allows authenticated merchants to access the shipping addresses of buyers from other shops by enumerating auto...

EUVD-2026-103037

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET...

PT-2026-116014

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/ord...