Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N H N N 7.1 .0024 13.5 —
AFFECTED Product Versions Fixed mall4j unspecified —
TIMELINE Sep 28 Reserved by VulnCheck Sep 28 Published (CNA: VulnCheck) Oct 1 EXPLOIT PUBLISHED — CVE-2026-102365 (gz-yami mall4j). Public exploit reference added.
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.
| Date | Event | Detail |
|---|---|---|
| September 28, 2026 | Reserved | Reserved by VulnCheck |
| September 28, 2026 | Published | Published (CNA: VulnCheck) |
| October 1, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-102365 (gz-yami mall4j). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| gz-yami | mall4j | — | — | — |
Authoritative record: CVE-2026-102365 at cve.org
Vendors: gz-yami
Weaknesses: CWE-862
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-102365 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
