Read the docs
TI-2026-65362 Aliases CVE-2026-102364GHSA-7f4q-fvgh-44w4

mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

Priority MEDIUM 57CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking @PreAuthorize permission checks, including menu listings, file uploads, and configuration endpoints.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00177 7th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gz-yamimall4jup to 4.0—No fix listedCNA
  • mall4j Vendorgz-yami Affected up to 4.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-102364
  2. 2026-10-03 Alias added: GHSA-7f4q-fvgh-44w4

References

Exploit 2

Other 2

  • TI-2026-65359 mall4j through 4.0 Missing Authentication in Password Update Endpoint CVSS 4.0CRITICAL 9.3
  • TI-2026-65360 mall4j through 4.0 Missing Authentication in Product Review Deletion CVSS 4.0MEDIUM 6.9
  • TI-2026-75401 Authorization bypass in Mall4cloud exposes buyer shipping addresses CVSS 4.0HIGH 7.1
  • TI-2026-65363 mall4j through 4.0 Missing Authorization in Admin User Address Endpoints CVSS 4.0HIGH 7.1
  • TI-2026-65361 mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number CVSS 4.0MEDIUM 6.3
  • TI-2026-70671 Operator precedence error in mall4j deletes other users' cart items CVSS 4.0MEDIUM 5.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences