Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
mall4j through 4.0 let anyone reset any storefront password. PUT /user/updatePwd took the target username from the request body and checked no session. CVE-2026-102361. The check for your own app: an endpoint that changes an account takes it from the session, not the payload.