HIGH
youlaitech
CVE published 2026-10-14
CVE-2026-110613
The youlai-mall application through commit 9f62de8 contains a missing authorization vulnerability in the app order list endpoint. This vulnerability allows authenticated members to view every customer's orders, including sensitive information such as order IDs, order_sn values, member IDs, payment amounts, and order status. The vulnerability is considered high-severity, with a CVSS score of 7.1, and defen [truncated]