Insecure direct object reference in BizSpring Shop order handling
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference in the OrderController cancel and receive handlers, tracked as CWE-639. An authenticated member can act on other members' orders by supplying their orderId. An attacker with a low-privilege member account can cancel a victim's pending order, which releases the allocated stock, or confirm receipt of a shipped order without the victim's consent.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
The sources list no fixed version for BizSpring Shop.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-10-14 Threatist record created from CVE-2026-110608
- 2026-10-14 Alias added: GHSA-p242-36gv-prqq
- 2026-10-16 CISA SSVC decision points changed
References
Other 4
- https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145
- https://github.com/bizspring-open/BizSpring-Java-Mall/blob/369e88c5cda36ddcea56742c335ee1bfe50e8156/bizspring-java/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145
- https://github.com/BizSpringSource/bizspring-shop-opensource
- https://github.com/bizspring-open/BizSpring-Java-Mall
More BizSpring vulnerabilities
- TI-2026-74101 Payment verification bypass in BizSpring Shop lets buyers skip payment CVSS 4.0HIGH 7.1
Sources
- CVE-2026-110608 · CVE Program
- CVE-2026-110608 · NVD
- FIRST EPSS
- GHSA-p242-36gv-prqq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences