CVE-2026-102362
mall4j through 4.0 Missing Authentication in Product Review Deletion
gz-yami mall4j
CVSS
6.9MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 29 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks.
Text from CVE List
Affected versions 1
- mall4jaffected: all versions through 4.0CVE List
References 4
- vulncheck.com/advisories/mall4j-through-4.0-missing-authentication-in-product-review-deletionAdvisoryvia CVE List
- github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A04_prodcomm_delete_anonymous.pyExploitvia CVE List
- github.com/gz-yami/mall4jReferencevia CVE List
- github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-api/src/main/java/com/yami/shop/api/controller/ProdCommController.java#L84-L89Referencevia CVE List