CVE-2026-111615 gz-yami CVE debrief

Who should care

Merchants and administrators of Mall4cloud installations should assess their exposure and prioritize remediation. They should verify their exposure by checking for affected versions and configurations, and review the vendor's remediation guidance. Security teams and vulnerability management teams should also be aware of this vulnerability and its potential impact on their organizations.

Why it matters

CVE-2026-111615 is a high-severity vulnerability in Mall4cloud that allows authenticated merchants to access sensitive buyer shipping addresses. Merchants and administrators should assess their exposure, prioritize remediation, and verify affected versions and configurations.

• Authenticated merchants can access sensitive buyer shipping addresses
• Enumeration of orderAddrId values can lead to unauthorized access to buyer information
• Remediation priority is high due to potential for data exposure
• Verification of affected versions and configurations is necessary

Technical summary

The vulnerability allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId} requests to obtain consignee names, mobile numbers, addresses, and post codes platform-wide. The vulnerability has been confirmed to exist in Mall4cloud version 4.0. Merchants and administrators should verify their exposure and review the vendor's remediation guidance. The CVE record was published on 2026-10-16T17:38:53.890Z and has not been modified since then.

Defensive priority

Merchants and administrators of Mall4cloud installations should verify their exposure and review the vendor's remediation guidance.

Recommended defensive actions

• Review and apply vendor remediation guidance for Mall4cloud version 4.0
• Verify exposure by checking for affected versions and configurations
• Monitor for unauthorized access to buyer shipping addresses
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. Supplemental sources include a technical description and third-party advisories. The vulnerability has been confirmed to exist in Mall4cloud version 4.0, and defenders should verify their exposure and review the vendor's remediation guidance. The CVE record was published on 2026-10-16T17:38:53.890Z and has not been modified since then. There are no known reports of exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.