yudao-cloud, versions through 2026.09, contains an insecure direct object reference that allows authenticated members to read after‑sale operation logs of other members by supplying arbitrary afterSaleId values. Because these logs contain refund amounts, status transitions, and timestamps, the flaw results in a confidentiality breach of sensitive transaction data. The weakness is classified as CWE‑639.

The affected vendor is YunaiV and the product is yudao‑cloud, specifically the mall trade module up to and including version 2026.09. No additional vendor or product information is available in the current data.

The CVSS score is 5.3, indicating moderate impact, and the EPSS score is not available, so the current likelihood of exploitation is unknown. Evading the flaw requires a valid member authentication, after which an attacker can enumerate consecutive afterSaleId values via the GET /app-api/trade/after-sale-log/list endpoint to retrieve sensitive records. Because the vulnerability resides in a publicly exposed API, it can only be exploited by authenticated users, which reduces the attack surface but still poses a significant confidentiality risk.