Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H N 9.3 .0037 28.2 —
AFFECTED Product Versions Fixed mall4j unspecified —
TIMELINE Sep 28 Reserved by VulnCheck Sep 28 Published (CNA: VulnCheck) Oct 1 EXPLOIT PUBLISHED — CVE-2026-102361 (gz-yami mall4j). Public exploit reference added.
mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.
| Date | Event | Detail |
|---|---|---|
| September 28, 2026 | Reserved | Reserved by VulnCheck |
| September 28, 2026 | Published | Published (CNA: VulnCheck) |
| October 1, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-102361 (gz-yami mall4j). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| gz-yami | mall4j | — | — | — |
Authoritative record: CVE-2026-102361 at cve.org
Vendors: gz-yami
Weaknesses: CWE-306
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-102361 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
