{"schema":"threatline.record/2","record":{"id":"CVE-2026-116015","aliases":[],"summary":"yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint","details":"yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.","categories":["Unclassified"],"product":"yudao-cloud","vendor":"YunaiV","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116015","source_modified_at":"2026-10-24T11:40:32.903Z","fetched_at":"2026-10-24T14:26:37.433577Z","product":"yudao-cloud","vendor":"YunaiV","versions":[{"version":"0","lessThanOrEqual":"2026.09","versionType":"custom","status":"affected"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-24T11:40:32.903Z","modified_at":"2026-10-24T11:40:32.903Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116015","fetched_at":"2026-10-24T14:26:37.433577Z","source_modified_at":"2026-10-24T11:40:32.903Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/YunaiV/yudao-cloud/issues/344","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/YunaiV/yudao-cloud/commit/df604fbd9824195ec3e48e2dfd3341c1d4e1edea","tags":["patch"]},{"source":"CVE List","url":"https://github.com/YunaiV/yudao-cloud/blob/593354d92a63f401ba73b95da868aade8c3d855d/yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/controller/app/aftersale/AppAfterSaleLogController.java#L33-L40","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/YunaiV/yudao-cloud/blob/593354d92a63f401ba73b95da868aade8c3d855d/yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/dal/mysql/aftersale/AfterSaleLogMapper.java#L13-L17","tags":["technical-description"]},{"source":"CVE List","url":"https://hackmd.io/@hieuPenguinnn/yudao-cloud-mall-after-sale-log-cross-member-idor","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/yudao-cloud-through-2026.09-idor-via-after-sale-log-list-endpoint","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-24T11:40:32.903Z","content_hash":"f1ee7d2f1cb502465808f8868935658a0dad2e4b029c5037fe3c306b49d7272c"}}