CVE-2026-102363

mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number

Published Sep 28, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.

Analysis

Technical impact

Mall4j through version 4.0 is missing authentication in the DeliveryController checkDelivery endpoint, allowing attackers to supply an order number and obtain full shipment tracking details. The disclosed information includes carrier names, waybill numbers and the complete logistics trail for any order. This represents a confidentiality breach as no identity or ownership verification is performed before data is returned, exposing sensitive logistical information to unauthenticated users.

Affected Systems

The vulnerability affects the Mall4j application developed by gz‑yami, impacting all releases up to and including version 4.0. Any deployment of these versions that exposes the DeliveryController checkDelivery endpoint to external clients is susceptible.

Risk and Exploitability

The CVSS score of 6.3 classifies the issue as moderate. EPSS information is not available, indicating that the current data does not provide a clear estimate of exploitation likelihood, but the vulnerability can be exploited remotely over the web interface without any credentials. The vulnerability is not listed in CISA’s KEV catalog. Attackers can obtain shipping details for any order simply by sending a request with an order number, making it trivial for malicious actors to gather potentially sensitive logistics data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

gz-yami

mall4j

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.0

No data.

Vendor Product Versions

Gz-yami

Mall4j

Version	Status	Scheme	Platform
`[0,4.0]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Contact gz-yami to obtain a patched release of Mall4j or an official update that enforces authentication for the DeliveryController checkDelivery endpoint.
If a patch is not yet available, restrict access to the checkDelivery endpoint by enforcing authentication, rate limiting, or IP whitelisting so that only authorized staff can retrieve shipment information.
Review the source code for the DeliveryController implementation to add proper ownership verification or session checks, ensuring that only the order owner or privileged roles can access tracking data.

Generated by OpenCVE AI on September 29, 2026 at 00:23 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.275% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A08_delivery_check_anonymous.py
https://github.com/gz-yami/mall4j
https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/DeliveryController.java#L47-L63
https://www.vulncheck.com/advisories/mall4j-through-4.0-unauthenticated-shipment-tracking-disclosure-via-order-number

History

Sep 29, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 29, 2026 1:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Gz-yami Gz-yami mall4j
Vendors & Products		Gz-yami Gz-yami mall4j

Sep 28, 2026 11:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.
Title		mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number
Weaknesses		CWE-306
References		https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A08_delivery_check_anonymous.py https://github.com/gz-yami/mall4j https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/DeliveryController.java#L47-L63 https://www.vulncheck.com/advisories/mall4j-through-4.0-unauthenticated-shipment-tracking-disclosure-via-order-number
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`