CVE-2026-110127 describes an insecure direct object reference in waynboot-mall's mobile CartController that permits an authenticated member to modify or delete cart items belonging to another member. The vulnerability arises because the system accepts raw cart identifiers without verifying ownership before performing operations such as quantity updates, selection toggling, or item removal. As a result, a malicious user can impact the integrity of other users' shopping carts, creating data tampering or potential financial loss if the cart data influences further processing.

waynboot-mall version 2.0.0 is affected. The issue exists in the mobile API endpoints exposed by the CartController and related CartServiceImpl. Any deployment of this version without applying the workaround is vulnerable; no specific OS or environment constraints are mentioned.

The CVSS score of 5.3 indicates moderate impact. The EPSS score is not available, but the absence of a KEV listing suggests no actively exploited public exploits yet. Attackers must be authenticated to exploit this flaw; the likely attack vector is through the exposed REST endpoints on the mobile API. Enumerating sequential cart IDs is straightforward, so an adversary can enumerate and test ownership checks easily. Because the flaw relies on ID enumeration and lack of ownership verification, the exploit is relatively low effort for anyone with valid credentials.