CVE-2026-110608

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110608", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-14T13:07:22.907Z", "datePublished": "2026-10-14T14:16:49.839Z", "dateUpdated": "2026-10-16T17:16:36.942Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-14T14:16:49.839Z"}, "datePublic": "2026-10-14T00:00:00.000Z", "title": "BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive", "descriptions": [{"lang": "en", "value": "BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "affected": [{"vendor": "BizSpring", "product": "BizSpring Shop", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "cf22d39daaf17f430d8fc1fb698a2f6e515e1808", "status": "affected", "versionType": "git"}], "packageURL": "pkg:github/BizSpringSource/bizspring-shop-opensource", "collectionURL": "https://github.com/BizSpringSource/bizspring-shop-opensource", "repo": "https://github.com/BizSpringSource/bizspring-shop-opensource"}, {"vendor": "BizSpring", "product": "BizSpring Java Mall", "repo": "https://github.com/bizspring-open/BizSpring-Java-Mall", "collectionURL": "https://github.com/bizspring-open/BizSpring-Java-Mall", "packageURL": "pkg:github/bizspring-open/BizSpring-Java-Mall", "versions": [{"version": "0", "lessThanOrEqual": "369e88c5cda36ddcea56742c335ee1bfe50e8156", "status": "affected", "versionType": "git"}], "defaultStatus": "unaffected"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-java-mall-payment-forgery-order-idor", "tags": ["third-party-advisory"]}, {"url": "https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145", "tags": ["technical-description"]}, {"url": "https://github.com/bizspring-open/BizSpring-Java-Mall/blob/369e88c5cda36ddcea56742c335ee1bfe50e8156/bizspring-java/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145", "tags": ["technical-description"]}, {"url": "https://github.com/BizSpringSource/bizspring-shop-opensource", "tags": ["product"]}, {"url": "https://github.com/bizspring-open/BizSpring-Java-Mall", "tags": ["product"]}, {"name": "VulnCheck Advisory: BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/bizspring-shop-through-commit-cf22d39daaf1-idor-via-member-order-cancel-and-receive"}], "credits": [{"lang": "en", "value": "hieuPenguinnn", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-16T16:31:08.640481Z", "id": "CVE-2026-110608", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T17:16:36.942Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-110608", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T16:31:08.640481Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T16:31:09.850Z"}}], "cna": {"title": "BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive", "credits": [{"lang": "en", "type": "finder", "value": "hieuPenguinnn"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/BizSpringSource/bizspring-shop-opensource", "vendor": "BizSpring", "product": "BizSpring Shop", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "cf22d39daaf17f430d8fc1fb698a2f6e515e1808"}], "packageURL": "pkg:github/BizSpringSource/bizspring-shop-opensource", "collectionURL": "https://github.com/BizSpringSource/bizspring-shop-opensource", "defaultStatus": "unaffected"}, {"repo": "https://github.com/bizspring-open/BizSpring-Java-Mall", "vendor": "BizSpring", "product": "BizSpring Java Mall", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "369e88c5cda36ddcea56742c335ee1bfe50e8156"}], "packageURL": "pkg:github/bizspring-open/BizSpring-Java-Mall", "collectionURL": "https://github.com/bizspring-open/BizSpring-Java-Mall", "defaultStatus": "unaffected"}], "datePublic": "2026-10-14T00:00:00.000Z", "references": [{"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-java-mall-payment-forgery-order-idor", "tags": ["third-party-advisory"]}, {"url": "https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145", "tags": ["technical-description"]}, {"url": "https://github.com/bizspring-open/BizSpring-Java-Mall/blob/369e88c5cda36ddcea56742c335ee1bfe50e8156/bizspring-java/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145", "tags": ["technical-description"]}, {"url": "https://github.com/BizSpringSource/bizspring-shop-opensource", "tags": ["product"]}, {"url": "https://github.com/bizspring-open/BizSpring-Java-Mall", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/bizspring-shop-through-commit-cf22d39daaf1-idor-via-member-order-cancel-and-receive", "name": "VulnCheck Advisory: BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-14T14:16:49.839Z"}}}, "cveMetadata": {"cveId": "CVE-2026-110608", "state": "PUBLISHED", "dateUpdated": "2026-10-16T17:16:36.942Z", "dateReserved": "2026-10-14T13:07:22.907Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-14T14:16:49.839Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/BizSpringSource/bizspring-shop-opensource", "defaultStatus": "unaffected", "packageURL": "pkg:github/BizSpringSource/bizspring-shop-opensource", "product": "BizSpring Shop", "repo": "https://github.com/BizSpringSource/bizspring-shop-opensource", "vendor": "BizSpring", "versions": [{"lessThanOrEqual": "cf22d39daaf17f430d8fc1fb698a2f6e515e1808", "status": "affected", "version": "0", "versionType": "git"}]}, {"collectionURL": "https://github.com/bizspring-open/BizSpring-Java-Mall", "defaultStatus": "unaffected", "packageURL": "pkg:github/bizspring-open/BizSpring-Java-Mall", "product": "BizSpring Java Mall", "repo": "https://github.com/bizspring-open/BizSpring-Java-Mall", "vendor": "BizSpring", "versions": [{"lessThanOrEqual": "369e88c5cda36ddcea56742c335ee1bfe50e8156", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent."}], "id": "CVE-2026-110608", "lastModified": "2026-10-16T19:03:18.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-110608", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T16:31:08.640481Z", "version": "2.0.3"}}]}, "published": "2026-10-14T15:17:12.613", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/BizSpringSource/bizspring-shop-opensource"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/BizSpringSource/bizspring-shop-opensource/blob/cf22d39daaf17f430d8fc1fb698a2f6e515e1808/bizspring-open/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/bizspring-open/BizSpring-Java-Mall"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/bizspring-open/BizSpring-Java-Mall/blob/369e88c5cda36ddcea56742c335ee1bfe50e8156/bizspring-java/bizspring-business/bizspring-order/src/main/java/cn/bizspring/cloud/order/admin/controller/shop/OrderController.java#L111-L145"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/bizspring-java-mall-payment-forgery-order-idor"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/bizspring-shop-through-commit-cf22d39daaf1-idor-via-member-order-cancel-and-receive"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,369e88c5cda36ddcea56742c335ee1bfe50e8156]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "BizSpring Java Mall", "source": "cna", "vendor": "BizSpring"}, "product": "bizspring_java_mall", "vendor": "bizspring"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,cf22d39daaf17f430d8fc1fb698a2f6e515e1808]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "BizSpring Shop", "source": "cna", "vendor": "BizSpring"}, "product": "bizspring_shop", "vendor": "bizspring"}], "created": "2026-10-15T02:45:11.390880+00:00", "updated": "2026-10-26T22:38:37.796941+00:00", "vendors": ["bizspring", "bizspring$PRODUCT$bizspring_java_mall", "bizspring$PRODUCT$bizspring_shop"]}