CVE-2026-102361

Summary

The flaw allows unauthenticated attackers to reset any storefront account password through the PUT /user/updatePwd endpoint, enabling account takeover and access to sensitive data.

Exploitability

Exploitation is relatively easy as it requires no authentication and can be performed by supplying a target username in the request body.

Blast radius

If exploited, attackers can gain full access to orders and personal data of any storefront account, leading to significant data breaches and potential financial loss.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to mall4j 4.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.