Mall4cloud versions up to 4.0 contain an insecure direct object reference that allows an authenticated merchant to read the shipping addresses of buyers from any shop on the platform. By repeatedly requesting the /m/order/order_addr/{orderAddrId} endpoint with sequential numeric identifiers, an attacker can enumerate order address records and extract field values such as consignee names, mobile numbers, street addresses, and postal codes. The vulnerability does not require elevated privileges beyond legitimate merchant credentials, making the data leak available to any shop owner on the instance.

The affected product is Mall4cloud from the vendor gz-yami, specifically versions 4.0 and earlier. All shops hosted on a vulnerable instance are potentially exposed, including those belonging to other merchants. The issue lies in the OrderController's getOrderAddr handler in the multishop module of the mall4cloud-order component.

The vulnerability carries a CVSS score of 7.1, meaning it is considered high severity. The EPSS score is unavailable but the lack of mitigation measures and the straightforward enumeration path make exploitation likely if an authenticated merchant is targeted. It is not listed in the CISA Known Exploited Vulnerabilities catalog, but the impact is nonetheless significant due to the privacy and competitive risk of exposing buyer addresses across all shops on a shared platform.