CVE-2026-110127: waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-26
Weakness: CWE-639

Description

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.

Affected products

wayn111 waynboot-mall: through 2.0.0

References

https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-common/src/main/java/com/wayn/common/core/service/shop/impl/CartServiceImpl.java#L151-L158
https://github.com/wayn111/waynboot-mall/blob/v2.0.0/waynboot-mobile-api/src/main/java/com/wayn/mobile/api/controller/CartController.java#L75-L101
https://github.com/wayn111/waynboot-mall/releases/tag/v2.0.0
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/waynboot-mall-mobile-member-ownership-idor
https://www.vulncheck.com/advisories/waynboot-mall-through-2.0.0-idor-via-mobile-cart-endpoints
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/waynboot-mall-mobile-member-ownership-idor

Get alerted when CVE-2026-110127 or the next vulnerability affects your stack