CVE-2026-110125
Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modif
CVSS
6.3
Medium
EPSS
0.3%
p16
KEV
—
Exploit Today
5
0-100
Published: Oct 13, 2026 · Last modified: Oct 16, 2026 · CWE-639
0.3%EPSS · 30 days0.3%
2026-10-142026-10-21
Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm, delete and refund endpoints to read recipient addresses and phone numbers or disrupt orders.
- github.comhttps://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-common/src/main/java/com/wayn/common/core/service/shop/impl/MobileOrderServiceImpl.java#L372-L473
- github.comhttps://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com/wayn/mobile/api/controller/OrderController.java#L41-L128
- github.comhttps://github.com/wayn111/waynboot-mall/releases/tag/v2.0.0
- hackmd.iohttps://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/waynboot-mall-mobile-member-ownership-idor
- www.vulncheck.comhttps://www.vulncheck.com/advisories/waynboot-mall-through-2.0.0-idor-via-mobile-order-endpoints
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1153346.8 MED—
———Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.22hCVE-2026-1153295.9 MED—
———Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.22hCVE-2026-1153265.4 MED—
———QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.22hCVE-2026-1153258.3 HIG—
———Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.22hCVE-2026-1153224.3 MED—
———Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.22hCVE-2026-1153214.3 MED—
———Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.22h