CVE-2026-102363
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter.
Does this matter?
Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.
Description
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.
- CVSS 4.0
- 6.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.27% probability · 20th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-306
- Source
- disclosure@vulncheck.com
EPSS moved from 0.3% on 29 September 2026 to 0.3% on 26 October 2026.
References
- https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A08_delivery_check_anonymous.py
- https://github.com/gz-yami/mall4j
- https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/DeliveryController.java#L47-L63
- https://www.vulncheck.com/advisories/mall4j-through-4.0-unauthenticated-shipment-tracking-disclosure-via-order-number
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.