CVE-2026-102363

Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.1

Description A missing authentication issue exists in the DeliveryController checkDelivery endpoint. This allows unauthenticated attackers to retrieve shipment tracking information, including carrier names, waybill numbers, and complete logistics trails for any order, by providing the order number parameter without ownership verification.

Recommendations Update mall4j to a version later than 4.0. As a temporary workaround, restrict access to the checkDelivery endpoint in the DeliveryController to minimize the risk of unauthorized data disclosure.