CVE-2026-79406: macrozheng mall quantity OmsCartItemServiceImpl.updateQuantity logic error

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-25 · updated 2026-08-27
Weakness: CWE-840

Description

A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantity. The manipulation of the argument quantity leads to business logic errors. The attack may be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation.

Affected products

macrozheng mall: 1.0.0, 1.0.1, 1.0.2, 1.0.3

References

https://github.com/macrozheng/mall/
https://github.com/macrozheng/mall/issues/984
https://vuldb.com/cve/CVE-2026-79406
https://vuldb.com/submit/886961
https://vuldb.com/vuln/394944
https://vuldb.com/vuln/394944/cti

Get alerted when CVE-2026-79406 or the next vulnerability affects your stack