CVE-2026-109406

The reported weakness occurs in the OmsPortalOrderServiceImpl implementation of the mall-portal component of macrozheng mall version 1.0.3 or earlier. Manipulating the coupon_amount or /order/generateOrder endpoint disrupts the business‑logic that calculates the final payable amount, potentially allowing an attacker to alter the amount charged or receive a lower price than intended. This weakness corresponds to CWE-840, which deals with business logic errors.

The flaw affects the macrozheng mall portal; any deployment using macrozheng:mall prior to a fix is vulnerable. The vendor’s public repository indicates that the last known affected version is 1.0.3, and no patch has yet been released. The vulnerability is scoped to the application layer and can be triggered remotely by an unauthenticated or authenticated client sending crafted parameters to the order generation API.

With a CVSS score of 5.3 the flaw falls in the medium range, and the EPSS metric is not available, while the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, involving an authenticated or unauthenticated client sending crafted parameters to the generateOrder endpoint to exploit the logic check that does not guard against negative or oversized amounts. This weakness is classified as CWE-840, indicating a business logic error that may lead to financial loss and is non‑trivial, especially in high‑volume transaction environments.