The vulnerability is a missing authorization flaw that lets any authenticated user retrieve complete order data for every customer through the app order list endpoint. A compromised account can paginate the oms_order table and read order identifiers, serial numbers, the original purchaser’s member ID, payment amounts, and order status. The weakness is a classic example of CWE‑639, where a system improperly verifies that a user is allowed to access a particular resource.

The affected product is youlaitech’s Youlai Mall application, specifically the iteration containing commit 9f62de8 in the mall‑oms module. All versions that include this commit may expose the flaw; no additional version constraints are listed.

The flaw has a CVSS score of 7.1, indicating a high severity risk. The EPSS score is 0.00415 (0.415%), indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers need only to register a legitimate account in the application; the API endpoint does not perform a member‑specific check, so an attacker can loop through page requests to enumerate all orders. The vulnerability does not require additional privileges beyond those granted to any logged‑in user.