CVE-2026-110608 BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive. This vulnerability allows authenticated members to act on other members' orders, potentially leading to unauthorized order cancellations or confirmations, stock allocation or fulfillment manipulation, and unauthorized actions on behalf of other members. Defenders of authenticated member order processing s [truncated]
CVE-2026-110607 is a payment verification bypass vulnerability in BizSpring Shop through commit cf22d39daaf1. An authenticated buyer can exploit this by calling the PaymentController.testPostPay handler to mark orders as paid. This allows for obtaining goods without payment or settling other members' orders. The vulnerability can be exploited by generating a payment log via /member/payment/load and reques [truncated]
