Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108691mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList

Medium 5.4

In plain English

A medium-severity security flaw in mall4j from gz-yami. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 85.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to /p/shopCart/cleanExpiryProdList to remove every user's cart entries for off-shelf products, which do not return when products are restocked.

Affected products (as reported)

Vendor	Product	Versions
gz-yami	mall4j	0 – through 4.0

Weakness: CWE-783 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

Researcher Proof of Concept exploit
Vulnerable Code (4.0) technical-description
Vulnerable Handler (4.0) technical-description
VulnCheck Advisory: mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList third-party-advisory