CVE-2026-102365 in mall4j
Summary
by MITRE • 09/29/2026
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in mall4j versions up to 4.0 represents a critical failure in access control mechanisms within the UserAddrController component of the application architecture. This flaw specifically affects GET requests directed at endpoints designed to retrieve customer address data, namely /user/addr/page and /user/addr/info. In a properly secured system, these endpoints should enforce strict authorization checks to ensure that an authenticated user can only access their own personal information or that administrative users have appropriate privileges for bulk operations. However, the implementation in mall4j lacks this necessary validation logic, allowing any authenticated session to bypass ownership verification and request address details belonging to other customers. This type of vulnerability is formally classified under CWE-285, which describes Improper Authorization, where a user is able to access or modify data for another entity without proper permission checks.
From an operational perspective, the impact of this flaw is severe due to the sensitivity of the exposed data fields. By exploiting these endpoints, an attacker can harvest comprehensive personally identifiable information including full names, telephone numbers, and detailed postal addresses. This capability transforms a simple authentication bypass into a significant privacy breach with potential downstream consequences such as identity theft, targeted phishing campaigns, or physical security risks for affected individuals. The ability to paginate through results via the /user/addr/page endpoint further exacerbates the risk by enabling automated scraping of large volumes of records in a single session, effectively turning the application into an information disclosure vector against its entire user base.
This vulnerability aligns with several techniques documented in the MITRE ATT&CK framework for enterprise environments. Specifically, it corresponds to T1078 Valid Accounts, as exploitation requires valid authentication credentials, and T1539 Steal Web Session Cookie if session hijacking is involved, though primarily it falls under data exfiltration patterns associated with unauthorized access to sensitive information stored in the application backend. The lack of object-level authorization checks means that the application fails to verify whether the requesting user has permission to view the specific resource being accessed, a common oversight in early-stage development or when rapid feature deployment overrides security review processes.
To mitigate this vulnerability, developers must implement robust access control logic within the UserAddrController methods handling these GET requests. The primary remediation strategy involves enforcing object-level authorization checks where the system verifies that the user ID associated with the current authenticated session matches the owner ID of the requested address record before returning any data. Additionally, implementing role-based access control can ensure that only users with specific administrative roles are permitted to query bulk datasets via pagination endpoints while regular customers remain restricted to their own records. Input validation and rate limiting should also be applied to prevent automated scraping attacks even after authorization is fixed. Regular security audits focusing on API endpoint permissions and the use of static application security testing tools can help identify similar gaps in other parts of the codebase before they are exploited in production environments.