CVE-2026-102364

Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.1

Description The software fails to validate the sysType field within sa-token sessions. This allows storefront customers to authenticate as back-office users by reusing their session tokens. An attacker can register on the public storefront and use their customer session token to access admin endpoints that lack @PreAuthorize permission checks, such as those used for menu listings, file uploads, and configuration.

Recommendations Update mall4j to a version later than 4.0.