---
id: CVE-2026-111615
title: Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint
summary: >-
  Mall4cloud through 4.0 contains an insecure direct object reference
  vulnerability that allows authenticated merchants to read other shops' buyer
  shipping addresses via the multishop OrderController getOrderAddr handler.
  Attackers can enu…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: gz-yami
product: mall4cloud
affected:
  - mall4cloud <= 4.0
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:38:53.890Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111615'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/mall4cloud-multishop-order-addr-cross-shop-idor
  - url: >-
      https://github.com/gz-yami/mall4cloud/blob/v4.0/mall4cloud-order/src/main/java/com/mall4j/cloud/order/controller/multishop/OrderController.java#L75-L80
  - url: >-
      https://github.com/gz-yami/mall4cloud/blob/v4.0/mall4cloud-order/src/main/resources/mapper/OrderAddrMapper.xml#L27-L29
  - url: >-
      https://www.vulncheck.com/advisories/mall4cloud-through-4.0-idor-exposing-buyer-addresses-via-order-addr-endpoint
    label: >-
      VulnCheck Advisory: Mall4cloud through 4.0 IDOR Exposing Buyer Addresses
      via order_addr Endpoint
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.694Z'
---

## Overview

Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses and post codes platform-wide.

## Affected

- `mall4cloud <= 4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.