Is CVE-2026-110126 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110126?

CVE-2026-110126 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-110126

Description

waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POST /address or DELETE /address/{addressId} requests to overwrite or remove victims' saved addresses.