CVE-2026-110608: BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-16
Weakness: CWE-639

Description

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.

References

https://github.com/BizSpringSource/bizspring-shop-opensource
https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145
https://github.com/bizspring-open/BizSpring-Java-Mall
https://github.com/bizspring-open/BizSpring-Java-Mall/blob/369e88c5cda36ddcea56742c335ee1bfe50e8156/bizspring-java/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-java-mall-payment-forgery-order-idor
https://www.vulncheck.com/advisories/bizspring-shop-through-commit-cf22d39daaf1-idor-via-member-order-cancel-and-receive

Get alerted when CVE-2026-110608 or the next vulnerability affects your stack