This vulnerability is an insecure direct object reference in Yshopmall’s after‑sales API, which allows any authenticated member to supply an after‑sales identifier and order code to view, modify or delete records belonging to other members. Affected actions include deleteAfterSalesOrder, addLogisticsInformation, or the GET /applyForAfterSales/{key} endpoint. The flaw can compromise the confidentiality of order information, alter shipping details, and delete after‑sales records, effectively violating both data integrity and privacy.

The issue affects Yshopmall products up to and including version 2.0.0 from the vendor guchengwuyue. Any installation of Yshopmall that has not been upgraded past 2.0.0 is vulnerable.

The CVSS score of 5.3 indicates a moderate impact, and the lack of an EPSS score means current exploitation risk is uncertain but potentially significant to any authenticated user. Attackers need only legitimate credentials; once logged in, they can easily manipulate identifiers to access other members’ after‑sales data. Because the vulnerability is not present in the CISA KEV catalog, it is not known to be actively exploited in the wild, but the moderate score and simple authentication requirement suggest that mitigating promptly is prudent.