https://vulnerability.circl.lu/sightings/feed 2026-10-20T14:27:38.184680+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/b17deed2-bb4a-42b0-820f-aec1c26f2b97/export 2026-10-20T14:27:38.213638+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b17deed2-bb4a-42b0-820f-aec1c26f2b97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-110613", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117440894644391721", "content": "CVE-2026-110613 youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account to read order ids, order_sn values, member ids, payment amounts, and order status.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110613https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/youlai-mall-order-list-cross-member-disclosurehttps://github.com/youlaitech/youlai-mall/blob/9f62de811d478b3ab6b27438efd58e2c4fdb4c31/mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java#L33-L38https://github.com/youlaitech/youlai-mall/blob/9f62de811d478b3ab6b27438efd58e2c4fdb4c31/mall-oms/oms-boot/src/main/resources/mapper/OmsOrderMapper.xml#L15-L52https://github.com/youlaitech/youlai-mallhttps://www.vulncheck.com/advisories/youlai-mall-through-commit-9f62de8-order-information-disclosure-via-app-order-list#youlaitech #youlai-mall#CVE_2026_110613#bot", "creation_timestamp": "2026-10-14T19:23:59.215624Z"} 2026-10-14T19:23:59.215624+00:00