CVE-2026-110126 in waynboot-mall
Summary
by MITRE • 10/13/2026
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/{addressId} requests to overwrite or remove victims' saved addresses.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified vulnerability represents a classic insecure direct object reference flaw within the AddressController component of waynboot-mall versions up to 2.0.0. This security defect stems from an insufficient authorization check that fails to validate whether the authenticated user initiating the request is the legitimate owner of the target resource. In this specific implementation, the application relies on auto-incrementing integer identifiers for shipping addresses without implementing proper access control mechanisms to bind these identifiers to the requesting session or user account. Consequently, any authenticated member can manipulate address records belonging to other users by simply guessing or enumerating sequential identifier values.
From a technical perspective, the exploitation vector involves sending HTTP POST requests to /address with payload data intended for another user's profile, or issuing DELETE requests against endpoints such as /address/{addressId} where {addressId} is an arbitrary integer corresponding to a victim's record. The server processes these commands based solely on the validity of the authentication token rather than verifying ownership of the specific address ID provided in the request parameters. This lack of object-level authorization allows attackers to overwrite critical shipping information or permanently remove saved addresses, effectively disrupting the operational integrity of other users' accounts without needing elevated privileges beyond basic membership status.
The operational impact of this vulnerability is significant for both end-users and platform administrators. For individual members, successful exploitation can lead to delivery failures if their shipping details are replaced with malicious addresses, potentially resulting in financial loss or receipt of unwanted goods. Furthermore, the ability to delete existing addresses causes inconvenience and requires time-consuming recovery processes. From a broader security standpoint, this flaw facilitates account takeover scenarios where an attacker might use address modification as a step toward resetting passwords via email-based verification systems that rely on shipping data for identity confirmation. It also undermines trust in the platform's ability to protect sensitive personal information stored within user profiles.
This vulnerability aligns with CWE-639, which describes issues related to authorization bypasses through direct object references, and maps directly to MITRE ATT&CK technique T1078, specifically valid accounts used for unauthorized access or manipulation of resources. To mitigate this risk, developers must implement robust object-level access controls that verify the relationship between the authenticated user session and the resource identifier being accessed. This can be achieved by storing the owner's user ID within each address record and validating it against the current session context before executing any modification or deletion operations. Additionally, implementing rate limiting on these endpoints and using non-sequential identifiers such as UUIDs can reduce the ease of enumeration for potential attackers while adding an extra layer of obscurity to resource identification.