CVE-2026-108690 in mall4j
Summary
by MITRE • 10/11/2026
mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList to retrieve off-shelf product basket entries including product, SKU, quantity, shop, and promoter card numbers.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified within mall4j versions up to 4.0 represents a significant information disclosure flaw rooted in improper operator precedence during SQL query construction. This specific technical defect occurs when the application processes requests for shopping cart expiration items via the endpoint GET /p/shopCart/expiryProdList. The core issue lies in how the backend logic constructs and executes the underlying database filter, specifically within the getShopCartExpiryItems function. Due to a misinterpretation of operator precedence, the SQL query fails to correctly isolate data belonging exclusively to the authenticated user making the request. Instead, the flawed logic allows the query to bypass intended access controls, effectively returning results that encompass cart items from other users who share certain contextual attributes or simply due to the lack of strict isolation in the filtering mechanism.
From an operational perspective, this vulnerability enables any authenticated customer with a storefront account to perform unauthorized data retrieval. By crafting specific HTTP GET requests to the vulnerable endpoint, attackers can extract sensitive information belonging to other shoppers. The exposed data includes detailed product identifiers such as SKUs and names, precise quantities of items in cart, associated shop details, and critically, promoter card numbers which may contain personal or financial implications depending on their usage context. This constitutes a direct violation of user privacy and data isolation principles, allowing one tenant's data to be accessible by another within the same multi-tenant environment if applicable, or simply violating single-user session integrity in standard deployments.
This vulnerability aligns with CWE-209, which describes the generation of an error message that reveals sensitive information, although in this case it is more accurately categorized under CWE-643 Improper Mitigation for XPATH Injection flaws involving SQL logic errors, or more broadly CWE-862 Missing Authorization. The attack vector leverages standard web interactions without requiring elevated privileges beyond a basic customer account, classifying the initial access as low complexity in terms of exploitation effort but high impact due to the breadth of data exposed. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1005 Data from Local System or T1113 Screen Capture depending on how the data is exfiltrated, specifically falling under Collection techniques where an adversary gathers information about a victim's activities within their own environment before potentially moving laterally.
To mitigate this vulnerability, developers must immediately patch mall4j to version 4.0 and above if available, or apply manual code fixes for earlier versions. The primary remediation involves refactoring the getShopCartExpiryItems SQL filter to ensure strict parameterization of user identifiers such as userId or sessionId within every query condition. It is essential to verify that all database queries explicitly bind the current authenticated user's identity to the data retrieval logic, preventing any possibility of cross-user data leakage through operator precedence errors. Additionally implementing input validation and ensuring that ORM frameworks are used correctly with explicit scope constraints can prevent similar logical flaws in future development cycles. Regular security code reviews focusing on SQL query construction patterns should be instituted to detect such logical bypasses before deployment.