{"id":"CVE-2026-116015","summary":"yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint","details":"yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.","modified":"2026-10-25T07:11:29.343683546Z","published":"2026-10-24T11:40:32.903Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"range":[{"last_affected":"2026.09"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]},{"extracted_events":[{"source":"DESCRIPTION","range":[{"last_affected":"2026.09"}]}]}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116015.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116015.json"},{"type":"PACKAGE","url":"https://github.com/YunaiV/yudao-cloud"},{"type":"ARTICLE","url":"https://github.com/YunaiV/yudao-cloud/blob/593354d92a63f401ba73b95da868aade8c3d855d/yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/controller/app/aftersale/AppAfterSaleLogController.java#L33-L40"},{"type":"ARTICLE","url":"https://github.com/YunaiV/yudao-cloud/blob/593354d92a63f401ba73b95da868aade8c3d855d/yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/dal/mysql/aftersale/AfterSaleLogMapper.java#L13-L17"},{"type":"FIX","url":"https://github.com/YunaiV/yudao-cloud/commit/df604fbd9824195ec3e48e2dfd3341c1d4e1edea"},{"type":"REPORT","url":"https://github.com/YunaiV/yudao-cloud/issues/344"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/yudao-cloud-mall-after-sale-log-cross-member-idor"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116015"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/yudao-cloud-through-2026.09-idor-via-after-sale-log-list-endpoint"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yunaiv/yudao-cloud","events":[{"introduced":"0"},{"fixed":"df604fbd9824195ec3e48e2dfd3341c1d4e1edea"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"df604fbd9824195ec3e48e2dfd3341c1d4e1edea"}]}]}}],"versions":["v2026.09(jdk17/21)","v2026.08(jdk17/21)","v2026.07(jdk17/21)","v2026.06(jdk17/21)","v2026.05(jdk17/21)","v2026.04(jdk17/21)","v2026.03(jdk17/21)","v2026.01(jdk17/21)","v2025.12(jdk17/21)","v2025.11(jdk17/21)","v2025.10(jdk17/21)","v2025.09(jdk17/21)","v2025.08(jdk17/21)","v2.6.1(jdk17/21)","v2.6.0(jdk17/21)","v2.5.0(jdk8/11)","v2.5.0(jdk17/21)","v2.4.2(jdk17/21)","v2.4.1(jdk8/11)","v2.4.1(jdk17/21)","v2.4.0(jdk17/21)","v2.3.0(jdk17/21)","v2.1.0(jdk17/21)","v1.9.0","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.7.3","v1.7.2","v1.7.1"],"database_specific":{"vanir_signatures_modified":"2026-10-25T07:11:29Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-116015.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/yunaiv/yudao-cloud/commit/df604fbd9824195ec3e48e2dfd3341c1d4e1edea","target":{"file":"yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/controller/app/aftersale/AppAfterSaleLogController.java"},"deprecated":false,"digest":{"line_hashes":["76535964696899350243178914975878407375","87050537074545663842442467044064679468","261570356355159830826913814530170797163","18794884864975327995353210521489814959","43496515335848247824365050377106664088","88202779661455254315507070015538634300","49161013988066497093884389638456360067","61008609655070218620533922064159399340","149319421322738154094867923454473613264","65902571619211804904645054741397116627","187645240114740838847920831146708346565","6967031419389757250980746645424330936","40168755932738408616509537353905336706","161180493543921037185601454644007045516","225550286129261883344848224260774227067","297696850416771004685822164654384773811","10851876735677236437493879566658935081"],"threshold":0.9},"id":"CVE-2026-116015-09bce51b","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"212064325149378680334987362375472246420","length":189},"id":"CVE-2026-116015-2ecc7c03","signature_type":"Function","signature_version":"v1","source":"https://github.com/yunaiv/yudao-cloud/commit/df604fbd9824195ec3e48e2dfd3341c1d4e1edea","target":{"file":"yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/controller/app/aftersale/AppAfterSaleLogController.java","function":"getAfterSaleLogList"}}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}