CVE-2026-110127

waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints

State: Published
Severity: 5.3 Medium
Published: Oct 13, 2026
Updated: Oct 26, 2026
Reserved: Oct 13, 2026

Description

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	VulnCheck

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
waynboot-mallwayn111	2.0.0 and earlierAffected

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/waynboot-mall-mobile-member-ownership-idorthird-party-advisory
https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com/wayn/mobile/api/controller/CartController.java#L75-L101technical-description
https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-common/src/main/java/com/wayn/common/core/service/shop/impl/CartServiceImpl.java#L151-L158technical-description
waynboot-mall v2.0.0 Release Notesrelease-notes
VulnCheck Advisory: waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpointsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.