Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108690mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList

Medium 4.3

In plain English

A medium-severity security flaw in mall4j from gz-yami. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 87.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList to retrieve off-shelf product basket entries including product, SKU, quantity, shop, and promoter card numbers.

Affected products (as reported)

Vendor	Product	Versions
gz-yami	mall4j	0 – through 4.0

Weakness: CWE-783 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Researcher Proof of Concept exploit
Vulnerable Code (4.0) technical-description
Vulnerable Handler (4.0) technical-description
VulnCheck Advisory: mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList third-party-advisory