Vulnerability · Published Sep 28, 2026 · Assigned by VulnCheck
CVE-2026-102363mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number
Low 3.7
In plain English
A low-severity missing authentication in mall4j from gz-yami. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.3%top 79.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A08_delivery_check_anonymous.py exploit
- https://github.com/gz-yami/mall4j product
- https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/DeliveryController.java#L47-L63 technical-description
- VulnCheck Advisory: mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number third-party-advisory