An insecure direct object reference flaw (CWE‑639) exists in the OrderController cancel and receive handlers of BizSpring Shop, allowing authenticated members to provide any orderId and act on orders belonging to other members. By supplying a victim’s order identifier, an attacker can cancel pending orders to release stock or confirm receipt of shipped orders, advancing fulfillment and settlement without the victim’s consent. The result is unauthorized order manipulation that can cause financial loss and operational disruption.

The vulnerability affects BizSpring Java Mall and BizSpring Shop. It is tied to the commit cf22d39daaf1 in the order module, but no explicit version range is provided; any release containing this commit is affected.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is less than 1%, showing a very low probability of exploitation at the time of this analysis. The flaw is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user and knowledge or enumeration of another member’s orderId, but once accessed the attacker can manipulate orders and incur financial harm.