CVE-2026-102365

MediumCVSS 6.5/10Last modified Oct 1, 2026

Description

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 29, 2026
Last modified: Oct 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1023664.4mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept CVE-2026-1023675.4mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enable CVE-2026-1023685.4Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physic CVE-2026-1023698.7Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handl CVE-2026-102374.7A vulnerability was found in SourceCodester Water Billing Management System 1.0. Impacted is an unknown function of the file /admin/?page=us CVE-2026-1023705.4Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloade CVE-2026-1023715.7In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu P CVE-2026-1023726.1GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers t CVE-2026-1023736.5GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authentic CVE-2026-1023746.1GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-enco CVE-2026-1023756.5Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels CVE-2026-1023767.1Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.