---
id: CVE-2026-110119
title: >-
  Yshopmall through 2.0.0 contains an insecure direct object reference
  vulnerability in the member address API that allows authenticated members to
  read, overwrite and delete other members' shipping addresses
summary: >-
  Yshopmall through 2.0.0 contains an insecure direct object reference
  vulnerability in the member address API that allows authenticated members to
  read, overwrite and delete other members' shipping addresses. Attackers can
  enumerate seque…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-639
vendor: guchengwuyue
product: yshopmall
affected:
  - yshopmall <= 2.0.0
published: '2026-10-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T14:52:58.417'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110119'
references:
  - url: >-
      https://github.com/guchengwuyue/yshopmall/blob/d1b20a2d76dfd98985410116db3aca8aca193b26/yshop-mall-boot/yshop-app/src/main/java/co/yixiang/modules/user/rest/UserAddressController.java#L117-L153
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/guchengwuyue/yshopmall/blob/d1b20a2d76dfd98985410116db3aca8aca193b26/yshop-mall-boot/yshop-mall/src/main/java/co/yixiang/modules/user/service/impl/YxUserAddressServiceImpl.java#L75-L114
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/yshopmall-member-api-ownership-idor
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/yshopmall-through-2.0.0-idor-via-member-address-api-in-useraddresscontroller
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/cve-2026-110119-110120-yshopmall-member-api-ownership-idor
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00335
epssPercentile: 0.26742
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-14T15:47:50.921718Z'
ingestedAt: '2026-10-13T17:38:53.190Z'
---

## Overview

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.