CVE-2026-102361: Gz-Yami MALL4J

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.

Affected products

• Gz-Yami MALL4J: up to and including 4.0

Published 2026-09-29. Last modified 2026-10-01.