CVE-2026-116015

The yudao-cloud platform (versions through 2026.09 ) contains an Insecure Direct Object Reference (IDOR) vulnerability within the mall trade module . The root cause is the lack of proper authorization checks when accessing the after-sale-log list endpoint . Authenticated members can bypass securi...

EUVD-2026-109273

yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against G...