CVE-2026-102364: Gz-Yami MALL4J

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking @PreAuthorize permission checks, including menu listings, file uploads, and configuration endpoints.

Affected products

• Gz-Yami MALL4J: up to and including 4.0

Published 2026-09-29. Last modified 2026-09-30.