CVE-2026-110119 yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/id, /address/del and...

CVE-2026-110119

Yshopmall versions through 2.0.0 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the member address API. The root cause allows authenticated members to access other users' shipping information by enumerating sequential address IDs via the /address/detail/{id} , /...