CVE-2026-116015
yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint
YunaiV yudao-cloud
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.
Text from CVE List
Affected versions 1
- yudao-cloudaffected: all versions through 2026.09CVE List
References 6
- github.com/YunaiV/yudao-cloud/commit/df604fbd9824195ec3e48e2dfd3341c1d4e1edeaFixvia CVE List
- hackmd.io/@hieuPenguinnn/yudao-cloud-mall-after-sale-log-cross-member-idorAdvisoryvia CVE List
- vulncheck.com/advisories/yudao-cloud-through-2026.09-idor-via-after-sale-log-list-endpointAdvisoryvia CVE List
- github.com/YunaiV/yudao-cloud/issues/344Referencevia CVE List
- github.com/YunaiV/yudao-cloud/blob/593354d92a63f401ba73b95da868aade8c3d855d/yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/controller/app/aftersale/AppAfterSaleLogController.java#L33-L40Referencevia CVE List
- github.com/YunaiV/yudao-cloud/blob/593354d92a63f401ba73b95da868aade8c3d855d/yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/dal/mysql/aftersale/AfterSaleLogMapper.java#L13-L17Referencevia CVE List