CVE-2026-110608
BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 14, 2026
- Updated
- Oct 16, 2026
- Reserved
- Oct 14, 2026
Description
BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
BizSpring ShopBizSpring |
|
BizSpring Java MallBizSpring |
|
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-java-mall-payment-forgery-order-idorthird-party-advisory
- https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145technical-description
- https://github.com/bizspring-open/BizSpring-Java-Mall/blob/369e88c5cda36ddcea56742c335ee1bfe50e8156/bizspring-java/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145technical-description
- https://github.com/BizSpringSource/bizspring-shop-opensourceproduct
- https://github.com/bizspring-open/BizSpring-Java-Mallproduct
- VulnCheck Advisory: BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receivethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.