CVE-2026-102361

CriticalCVSS 9.1/10Last modified Oct 1, 2026

Description

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Sep 29, 2026
Last modified: Oct 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1023625.3mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attack CVE-2026-1023633.7mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthentica CVE-2026-1023645.4mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office us CVE-2026-1023656.5mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authent CVE-2026-1023664.4mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept CVE-2026-1023675.4mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enable CVE-2026-1023685.4Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physic CVE-2026-1023698.7Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handl CVE-2026-102374.7A vulnerability was found in SourceCodester Water Billing Management System 1.0. Impacted is an unknown function of the file /admin/?page=us CVE-2026-1023705.4Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloade CVE-2026-1023715.7In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu P CVE-2026-1023726.1GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers t