CVE-2026-102361

Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.0

Description A missing authentication flaw exists in the 'PUT /user/updatePwd' endpoint. This allows unauthenticated attackers to reset the password of any storefront account by providing a target username in the request body. Because the system fails to verify the session, an attacker can overwrite passwords to achieve account takeover and gain unauthorized access to personal data and orders.

Recommendations Update to a version newer than 4.0. As a temporary mitigation, restrict access to the 'PUT /user/updatePwd' endpoint.