The vulnerability in mall4j 4.0 allows an attacker that is not authenticated to remove any product review by sending a DELETE request to the /prodComm endpoint with a prodCommId value, because the application does not perform an authentication check before deletion. This enables an attacker to delete arbitrary records, corrupting data integrity and potentially disrupting the user experience by removing legitimate reviews.

The affected product is the mall4j framework made by gz‑yami, specifically all releases up to and including version 4.0. No sub‑version or patch information is provided, so any deployment of mall4j 4.0 or earlier may be vulnerable.

The CVSS score of 6.9 places the vulnerability at a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a moderate likelihood of exploitation but not currently known to be actively exploited. The likely attack vector is an unauthenticated HTTP DELETE request to the product review endpoint, which can be performed from any network that can reach the API, including internal and external networks. The lack of authentication checks allows any attacker who can reach the endpoint to delete any review by simply knowing the prodCommId.