CVE-2026-15186: IDOR in macrozheng mall Return Application Endpoint

Technical summary

CVE-2026-15186 is an improper control of resource identifiers (CWE-99) vulnerability in the Portal Endpoint of macrozheng mall. The flaw exists in the /returnApply/create endpoint, which fails to validate that the orderId parameter belongs to the authenticated user before processing the return application request. This insecure direct object reference (IDOR) pattern allows any logged-in user to create return applications for orders they do not own, potentially accessing sensitive order data or manipulating fulfillment workflows. The vulnerability affects macrozheng mall through version 1.0.3.

Business impact

This vulnerability could disrupt order management and customer service operations. Attackers with valid credentials could create fraudulent return requests for other customers' orders, leading to compliance issues, customer disputes, and reputational damage. The ability to reference arbitrary orders may also expose sensitive customer information such as order details and personal data. For organizations using macrozheng mall in production, remediation becomes a priority to prevent unauthorized access to customer transactions.

Affected systems

macrozheng mall versions up to and including 1.0.3 are affected. The vulnerability is present in the Portal Endpoint component, specifically the /returnApply/create function. Organizations running instances of this e-commerce platform should verify their deployment version immediately.

Exploitability

The vulnerability is rated MEDIUM (CVSS 6.3) with low attack complexity and no required special privileges beyond a standard user account. Exploitation requires network access and valid authentication credentials, but does not demand user interaction or system compromise. The availability of a public exploit and the straightforward parameter manipulation required make this a practical attack vector. While the barrier to entry is not trivial, the ease of exploitation once authenticated presents meaningful risk.

Remediation

Upgrade macrozheng mall to a patched version that implements proper authorization checks for the orderId parameter. Verify against the vendor's official advisory for the corrected version number. Additionally, implement server-side validation to ensure that return applications can only be created for orders belonging to the authenticated user. Code review of similar endpoints should be performed to identify and fix related IDOR patterns.

Patch guidance

Contact the macrozheng mall vendor or check their official repository for a security patch addressing this vulnerability. Given that the vendor previously deleted the GitHub issue without explanation, confirm patch availability through official channels before proceeding. Apply patches in a staging environment first and validate that return application workflows function correctly post-update. If a patch is not yet available, consider implementing a temporary workaround via API gateway rules that validate orderId ownership before routing requests to the vulnerable endpoint.

Detection guidance

Monitor for suspicious patterns in /returnApply/create requests, such as rapid requests from a single user account creating returns for multiple distinct orderId values that do not align with that user's known orders. Implement logging of orderId parameters and correlate them against the authenticated user's order history. Anomalies—such as a return request for an order belonging to a different customer account—should trigger alerts. Additionally, review API access logs for the modified date window (around 2026-07-09) to identify any prior exploitation.

Why prioritize this

Although CVSS severity is MEDIUM, prioritization should be elevated due to the public availability of an exploit and the direct impact on customer data integrity and order management. The fact that the vendor deleted the GitHub issue without providing a transparent fix raises concerns about support timelines. For any organization with active customer-facing e-commerce operations, this vulnerability warrants prompt assessment and remediation planning.

Risk score, explained

The CVSS 6.3 score reflects that exploitation requires authentication (lowering severity from HIGH), but the network accessibility, low attack complexity, and confidentiality/integrity/availability impact all contribute to MEDIUM classification. The public exploit availability and the absence of KEV status should not lower internal risk prioritization; organizations should treat this as operationally significant despite the moderate numeric score.

Frequently asked questions