Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck
CVE-2026-110608BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive
Medium 5.4
In plain English
A medium-severity authorization bypass via user-controlled key in BizSpring Java Mall from BizSpring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BizSpring | BizSpring Shop | 0 – through cf22d39daaf17f430d8fc1fb698a2f6e515e1808 |
| BizSpring | BizSpring Java Mall | 0 – through 369e88c5cda36ddcea56742c335ee1bfe50e8156 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-java-mall-payment-forgery-order-idor third-party-advisory
- https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145 technical-description
- https://github.com/bizspring-open/BizSpring-Java-Mall/blob/369e88c5cda36ddcea56742c335ee1bfe50e8156/bizspring-java/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145 technical-description
- https://github.com/BizSpringSource/bizspring-shop-opensource product
- https://github.com/bizspring-open/BizSpring-Java-Mall product
- VulnCheck Advisory: BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive third-party-advisory