CVE-2026-102362

Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.1

Description The software fails to implement authentication controls on the 'DELETE /prodComm' endpoint within the ProdCommController. This allows unauthenticated attackers to delete arbitrary product reviews by providing the prodCommId parameter without undergoing authorization checks.

Recommendations Update mall4j to a version later than 4.0. As a temporary workaround, restrict access to the 'DELETE /prodComm' endpoint to prevent unauthorized deletions.