CVE-2026-110120 | guchengwuyue Yshopmall up to 2.0.0 After-Sales API after_sales_id/orderCode authorization

October 13, 2026 Yanac

A vulnerability was found in guchengwuyue Yshopmall up to 2.0.0. It has been declared as critical. Affected by this issue is the function deleteAfterSalesOrder/addLogisticsInformation/applyForAfterSales of the component After-Sales API. Such manipulation of the argument after_sales_id/orderCode leads to authorization bypass.

This vulnerability is documented as CVE-2026-110120. The attack can be executed remotely. There is not any exploit available.VulDB Recent EntriesRead More