CVE-2023-36331 — Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId

Back Back to CVE browser

HIGH

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId

Published Jan 12, 2026

8.2

HIGH

CVSS 3.1

EPSS 0.23%

Description

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.23% 0.00234

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00234

Score over time

Jan–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.23% (0.00234)	12.99th	v5 (v2026.06.15)
Jun 15, 2026	0.21% (0.00206)	10.61th	v5 (v2026.06.15)
Jan 13, 2026	0.03% (0.00030)	8.14th	v4 (v2025.03.14)

Weaknesses (1)

CWE-639

Authorization Bypass

References (1)

https://github.com/Exrick/xmall/issues/100
ExploitIssue TrackingThird Party Advisory

Link	Providers	Tags
https://github.com/Exrick/xmall/issues/100		ExploitIssue TrackingThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jan 12, 2026

Updated Jan 12, 2026

Reserved Jun 21, 2023

Link CVE-2023-36331

CISA Vulnrichment

Updated Jan 12, 2026

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2023-36331

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-36331