TI-2026-72010 Aliases CVE-2026-110126 GHSA-rrcp-3x9c-4qr5

Insecure direct object reference in waynboot-mall address endpoints

LOW 24CWE-639Published 2026-10-13 · Updated 2026-10-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

waynboot-mall through 2.0.0 contains an insecure direct object reference in AddressController that lets an authenticated member change or delete other members' shipping addresses. An attacker can enumerate auto-increment address ids and send POST /address or DELETE /address/{addressId} requests to overwrite or remove a victim's saved addresses. The flaw is tracked as CWE-639, authorization bypass through a user-controlled key, and needs only low privileges over the network.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/{addressId} requests to overwrite or remove victims' saved addresses.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00278 20th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
wayn111	waynboot-mall	up to 2.0.0	—	No fix listed	CNA

waynboot-mall Vendorwayn111 Affected up to 2.0.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for waynboot-mall.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Timeline

2026-10-13 Threatist record created from CVE-2026-110126
2026-10-13 Alias added: GHSA-rrcp-3x9c-4qr5

References

Patch 1

https://github.com/wayn111/waynboot-mall/commit/0ef8fa4a951fc1f6d57f3e12e37c31490e886a64

Advisory 1

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/waynboot-mall-mobile-member-ownership-idor

Other 2

TI-2026-75446 Missing authentication in waynboot-mall lets attackers cancel orders CVSS 4.0MEDIUM 6.9
TI-2026-75445 Missing authentication in Waynboot-mall allows forged orders CVSS 4.0MEDIUM 6.9
TI-2026-72011 Insecure direct object reference in waynboot-mall mobile cart endpoints CVSS 4.0MEDIUM 5.3
TI-2026-75447 Missing authentication in waynboot-mall lets attackers send email CVSS 4.0MEDIUM 6.9
TI-2026-72009 Insecure direct object reference in waynboot-mall exposes member orders CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences