CVE-2026-102363 in mall4j
Summary
by MITRE • 09/29/2026
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The identified security flaw resides within the mall4j framework version 4.0, specifically affecting the DeliveryController component's checkDelivery endpoint. This vulnerability represents a critical failure in access control mechanisms, classified under CWE-287 as an Improper Authentication issue. The core technical deficiency lies in the absence of any authentication or authorization checks before processing requests to retrieve shipment tracking data. Consequently, the system fails to verify whether the requesting entity is authorized to view specific logistics information associated with a given order number. This lack of verification allows unauthenticated actors to bypass security controls entirely by simply providing an order identifier as a parameter in their HTTP request.
From an operational perspective, this vulnerability enables significant privacy breaches and potential business intelligence theft. Attackers can exploit the endpoint to access sensitive customer data including carrier names, waybill numbers, and complete logistics trails for any arbitrary order number they might guess or obtain through other means. The ability to retrieve such detailed information without ownership verification undermines the confidentiality of user data and exposes customers to risks such as package interception, social engineering attacks based on delivery schedules, or targeted fraud. Furthermore, this exposure can reveal supply chain patterns that competitors could leverage for strategic advantage.
In terms of threat modeling, this vulnerability aligns with MITRE ATT&CK technique T1078, specifically the Valid Accounts sub-technique if valid credentials were previously compromised to enumerate order IDs, but more accurately reflects a lack of access control allowing anonymous enumeration similar to CWE-640 Weak Password Recovery Mechanism for Sensitive Data in terms of information disclosure. The attack vector is straightforward and does not require complex exploitation chains; it relies on the direct interaction with an API endpoint that lacks proper input validation regarding user identity. This simplicity increases the likelihood of automated scanning tools detecting and exploiting this weakness across large numbers of instances quickly.
To mitigate this vulnerability, developers must implement robust authentication checks at the controller level before any business logic is executed. It is essential to ensure that only authenticated users who are explicitly linked to a specific order can retrieve its tracking information. This involves validating session tokens or API keys and cross-referencing them with database records to confirm ownership of the requested resource. Additionally, implementing rate limiting on this endpoint can help mitigate brute-force attempts if attackers attempt to enumerate valid order numbers systematically. Regular security audits and static code analysis focused on access control patterns are recommended to prevent similar oversights in future development cycles.