CVE-2026-10070: macrozheng mall Super Admin Password update improper authorization

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-29 · updated 2026-07-21
Weakness: CWE-266

Description

A vulnerability was found in macrozheng mall up to 1.0.3. This affects an unknown function of the file /admin/update/ of the component Super Admin Password Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

Affected products

macrozheng mall: 1.0.0, 1.0.1, 1.0.2, 1.0.3

References

https://github.com/macrozheng/mall/
https://github.com/macrozheng/mall/issues/970
https://vuldb.com/submit/818384
https://vuldb.com/vuln/367156
https://vuldb.com/vuln/367156/cti

Get alerted when CVE-2026-10070 or the next vulnerability affects your stack