What is CVE-2026-102363?

CVE-2026-102363 is a low-severity vulnerability in Gz-Yami Mall4j, classified under Missing Authentication for Critical Function. CVSS score: 3.7/10. Published 2026-09-29.

How severe is CVE-2026-102363?

Low severity. CVSS v3 base score is 3.7 out of 10.

Auth bypass in Gz-Yami Mall4j

CVE-2026-102363

mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated attackers to read shipment tracking information by supplying an order number parameter. Attackers can access carrier names, waybill numbers, and complete logistics trails for any order without authentication or ownership verification.

Vulnerability class: Broken Authentication

Published 2026-09-29.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Gz-Yami Mall4j

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9a… (exploit)
github.com/gz-yami/mall4j (product)
github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-sh… (technical-description)
www.vulncheck.com/advisories/mall4j-through-4.0-unauthenticated-shipment-tracki… (third-party-advisory)

Frequently asked questions

What is CVE-2026-102363?: CVE-2026-102363 is a low-severity vulnerability in Gz-Yami Mall4j, classified under Missing Authentication for Critical Function. CVSS score: 3.7/10. Published 2026-09-29.
How severe is CVE-2026-102363?: Low severity. CVSS v3 base score is 3.7 out of 10.