{"id":"CVE-2026-102367","summary":"mall4j through 4.0 Insufficient Session Expiration via Token Refresh","details":"mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.","modified":"2026-09-30T08:04:57.927811Z","published":"2026-09-28T23:34:31.264Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-613"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102367.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102367.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102367"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/mall4j-through-4.0-insufficient-session-expiration-via-token-refresh"},{"type":"PACKAGE","url":"https://github.com/gz-yami/mall4j"},{"type":"ARTICLE","url":"https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/controller/TokenController.java#L38-L44"},{"type":"ARTICLE","url":"https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/manager/TokenStore.java#L121-L130"},{"type":"EVIDENCE","url":"https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/T02_refresh_token_enabled_bypass.py"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gz-yami/mall4j","events":[{"introduced":"ffc672fc1aa4320ce02d0b93853bb456ae0a4dae"},{"fixed":"ffc672fc1aa4320ce02d0b93853bb456ae0a4dae"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"4.0"},{"introduced":"mall4j"},{"fixed":"4.0"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102367.json","vanir_signatures_modified":"2026-09-30T08:04:57Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/Transport.java"},"deprecated":false,"digest":{"line_hashes":["67860164633184014383760684265829188722","42501909667163602863054736059203563380","231728903954684254602606459241867689576","114908228088978152467191003178031489837","327544401581194744885245332117561519945","290716537883675564672815526817959014216","244352567336089811046452270280185237773","10065163174717105093597205462045980933"],"threshold":0.9},"id":"CVE-2026-102367-0093e010"},{"target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/xss/XssWrapper.java"},"deprecated":false,"digest":{"line_hashes":["301109766061885803831418636668313973732","88505119894448127258449680105562896788","204450323617217596710906302912835394822","260987185811679200510741962207125812887","21031075997118309479674850728552928192"],"threshold":0.9},"id":"CVE-2026-102367-01126e02","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae"},{"deprecated":false,"digest":{"line_hashes":["170329492573820207731061868046265207766","323521614757495907585222660917594524291","203168096964516867830447830612078618644","286254559581434165089421959083376668174","313561465388706282359516172596142834930","205855146118535440967540326342493045280","21311994223246375394188510773668508010","293096496841290118517298569826754442282","211777793217549449015393885180591730212","236851260720699085646532703720006775578","89144011929391222512996703993573323656","198679508569497850033070988715931791877","285526055507411243584085151492673647439","297434480796190883134939383978578057030","110349831218123746921303397868239815842","32668139193479792596291234234831799759","243183345934831505357970001210063638112","83769929201634579820908681288219989967","252531301653391719811668436681423017429","183477724550780364990151881662802784463","201718131262437669670414418659952784078","182023671041698907391693336717261558998","193493146424120173546887456273070223074","32923256917039000761873183972598241987"],"threshold":0.9},"id":"CVE-2026-102367-015ac9e7","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/util/Json.java"}},{"digest":{"function_hash":"258425076419855390225531983911619507569","length":877},"id":"CVE-2026-102367-06f26a83","signature_type":"Function","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/serializer/json/ImgJsonSerializer.java","function":"serialize"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["188089935996414838722885631734850279738","321462281667418462638012729530446128019","230232583090138126887907408130071659103","170828721334260119474912419376680944083","83345651879261626676319830739876734752","285485958019704128122809835001862634626"]},"id":"CVE-2026-102367-088c4fc1","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/exception/YamiShopBindException.java"}},{"signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/manager/TokenStore.java"},"deprecated":false,"digest":{"line_hashes":["290242786752278702788187022995682415477","167334392617019754866559979588217774091","188320384846084122777050714799521077337","251597373133414035099074420046338067274","144757007929540518448803509819547365979","118125292763721673202644574037989754921","283294622532658591325930834637014433663","244314184227635465739475019616396980674","143749543158835073088031434523842801130","305981086186965983726968660218895085481","57831055060890848623351449107232214370","314497516378380071000634371546234640552","257159603340047645152294853886379434098","301103982405445069880591012611627003341","217540390431720574888665524876705764489"],"threshold":0.9},"id":"CVE-2026-102367-09b04702","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/TranscityFree.java"},"deprecated":false,"digest":{"line_hashes":["24235960356762408481151873098449107948","270222908483367766323139995951925394683","127224554895140941270173949402275122644","267307360930378152415534599839737919424","310507772708311321086323998879391214189","311924979904434556672462608928860074892","267896715830886022936440193811650557864"],"threshold":0.9},"id":"CVE-2026-102367-0e65dfcf","signature_type":"Line"},{"target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/config/RedisCacheConfig.java","function":"redisSerializer"},"deprecated":false,"digest":{"function_hash":"35994193193622671978343325710993300979","length":670},"id":"CVE-2026-102367-14fcd379","signature_type":"Function","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae"},{"deprecated":false,"digest":{"line_hashes":["134595431431043258913574971917581273620","327280900193517922936994696567763983446","197478616468331867371177281138322525296","17041613803542884660166395449213637063","265754943159541638466869766714494148951","116491190737537360305527586476180199717","4109067189878709304857658378847167160","149461676589051993365770296823599423816","207485911532537107768611161439296280060","159278466814748516662348661682748657884","187019927149149823818273355789976320840"],"threshold":0.9},"id":"CVE-2026-102367-1c3d3b7f","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/handler/HttpHandler.java"}},{"source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/config/DefaultExceptionHandlerConfig.java","function":"methodArgumentNotValidExceptionHandler"},"deprecated":false,"digest":{"function_hash":"312905665211207923172922331863890412252","length":801},"id":"CVE-2026-102367-1c70376d","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["172542124982409367390643620646121932490","98017927995834798881964566580575762711","290281817137846868905664377785984056050","66541841276848317517600378506657969745","197761590022396808627410924466281582292","65918897830609952997448703787476300483"],"threshold":0.9},"id":"CVE-2026-102367-20b325b1","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/OrderItem.java"}},{"signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-sys/src/main/java/com/yami/shop/sys/model/SysUserRole.java"},"deprecated":false,"digest":{"line_hashes":["172542124982409367390643620646121932490","59748505119757864526826089986550070354","24304958222562504906457421897409640759","68247488213166402601614210204589985069","33441778475840970680654609595985975185","14768500149296352329334922793874050871","296688488709782299299390576594350162527"],"threshold":0.9},"id":"CVE-2026-102367-2bca95a1","signature_type":"Line"},{"target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/BasketItemDto.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["3476575608821870237461580211379252766","101093891514446649679022799909165255741","168891297852367452043978887195571100803"]},"id":"CVE-2026-102367-3a3e0670","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/filter/AuthFilter.java","function":"doFilter"},"deprecated":false,"digest":{"function_hash":"287288596133228507771237744182840484436","length":1211},"id":"CVE-2026-102367-3d8210ec"},{"digest":{"line_hashes":["79232852935200949566949946859850229371","196782924361801994370364360344787022036","102744242019256303506093770650916471979","254672826927567100703601597240797218837","192265822126799538391252838870811620429","34536093395112350788745479380221719875","155324999921238541598921585437692754156","174458342356951526685598969875184120948"],"threshold":0.9},"id":"CVE-2026-102367-40438c4e","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-sys/src/main/java/com/yami/shop/sys/model/SysMenu.java"},"deprecated":false},{"id":"CVE-2026-102367-41e7ec6f","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/Product.java"},"deprecated":false,"digest":{"line_hashes":["66671481739388206739598897906438521056","61767912262412522285101033128669463541","84440829490520795933501777265233606216","10198737929313081990207056348826870282","197813886782614901047138314486429004725","38787237603848499063370261359700466206","162729310077084223271874512953346577643","282667778343238282191905607891133383082"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/ProdComm.java"},"deprecated":false,"digest":{"line_hashes":["222128565019452547281640609442270616357","335339648938429803824554218873711433194","65376842701216430602139425994219423931","182089593163745867252882993079920398575","317334424381344099397315064174842570116","255928337351899410326583004785715675629","132354286816338514454488482768326242045","145058926915464866456192048671259740338","106647684650067780039667003713238798645","135788164687959031050266268472579697939","142214574335137789499933558200363293243","76092115524440837937968994454543264227","207474028115536312133677947089253539911"],"threshold":0.9},"id":"CVE-2026-102367-5297d321","signature_type":"Line"},{"source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/handler/HttpHandler.java","function":"printServerResponseToWeb"},"deprecated":false,"digest":{"length":756,"function_hash":"12454200127138889380311152391198202591"},"id":"CVE-2026-102367-58118e6e","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-102367-5d109855","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/ShopDetail.java"},"deprecated":false,"digest":{"line_hashes":["181622616876745818625794156012369877461","298548088878332749307830827807973501011","2977936422829128304814592648575183892","258941135407583476848140479984814896751","297866550303925996650887135215141797461"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["334021840009879247581315768753024403724","123888199784086392601770907281005158009","60154089785194063425711284236563724812","311009030822188869436321106620080724522","136798732664950780894442091128995443680","124143297336050166780060478011543787555","230639923380358832698777385800359913722","100615913963939533823048023775291892575"],"threshold":0.9},"id":"CVE-2026-102367-5d62db6e","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/config/DefaultExceptionHandlerConfig.java"}},{"id":"CVE-2026-102367-63dea6ef","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/Order.java"},"deprecated":false,"digest":{"line_hashes":["83551807861501037584926975251999887717","50534897015676397959509493876597731522","106647684650067780039667003713238798645","80838917524837005853378255346292192658","72536226474482827436065856372428880353","264916905061244305047841804490394230202","315141870983922708280057204926196917443"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["304620355501212156588851171715301460871","168891297852367452043978887195571100803"],"threshold":0.9},"id":"CVE-2026-102367-70d0df94","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/CategoryDto.java"}},{"target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/util/IpHelper.java"},"deprecated":false,"digest":{"line_hashes":["102321462261863848627413018980340935316","163623463966179764819486833551798495311","278546863516451136661587803297018110147"],"threshold":0.9},"id":"CVE-2026-102367-7314d3b1","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae"},{"signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/dto/SearchProdDto.java"},"deprecated":false,"digest":{"line_hashes":["312869628152696131523293135010924483555","168891297852367452043978887195571100803"],"threshold":0.9},"id":"CVE-2026-102367-82e5d739","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["172542124982409367390643620646121932490","59748505119757864526826089986550070354","331985901616535226673270973670473314879","192584708142535870522947776028726773632","199410375204071165950936207606573616577","287577134525495699132893853719460639245","125210133831932765945891939760974038693"],"threshold":0.9},"id":"CVE-2026-102367-86d7278e","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-sys/src/main/java/com/yami/shop/sys/model/SysRoleMenu.java"}},{"id":"CVE-2026-102367-89a07cbb","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/ProductItemDto.java"},"deprecated":false,"digest":{"line_hashes":["3476575608821870237461580211379252766","101093891514446649679022799909165255741","168891297852367452043978887195571100803"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-sys/src/main/java/com/yami/shop/sys/model/SysUser.java"},"deprecated":false,"digest":{"line_hashes":["107608098972099137582780222058333648690","324356030093265683708903245115274147498","281138034028536639857225759664126578285","113390714014046033896457376053507291439","159513212726530089784797718729111124618","150491082977703362004908941800272097439","23000682524354102829309666648598759092","246531302237252046286643574688593070882"],"threshold":0.9},"id":"CVE-2026-102367-8a983b5c","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/serializer/json/ImgJsonSerializer.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["19605288997970589853334452541550487973","135193004513013819707132490824286777723","187567584338183856901306808417471383847","85169012499537764184035352195459606609","324710882731639787645319627695939182804","189157649153753306922274202254116336666","308493969922832921575216057943703064758","81261880956910045870645043489987697935","94523449588369388649209538846182188346","120885254696010913921571395401596293270","142175594705389124197152395530324856945","109326209981439370123028066783496942977","146233333014576778400859571798175110789","39716991217218600820134826488196308288","9578547870774640135090176767202084162"]},"id":"CVE-2026-102367-91230c39","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-admin/src/main/java/com/yami/shop/admin/controller/OrderController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["10368374635493220267687595296410098764","78717422594131498984288409464515591457","267288592504382668774725096392819484802","333476444350976273187472310768459833168","129187394430235192020230702620700674088"]},"id":"CVE-2026-102367-93060e09","signature_type":"Line"},{"digest":{"function_hash":"295632438189653856260646606186099187896","length":399},"id":"CVE-2026-102367-93939374","signature_type":"Function","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-admin/src/main/java/com/yami/shop/admin/controller/OrderController.java","function":"mergeIfNeed"},"deprecated":false},{"digest":{"line_hashes":["77633660919566992078695833508494038860","172034049187200615513561570059307895648","108984741007882726017722598770897408600","196500239672155147377346282120842552593","47097784198475938054367911898758255350","230379812567082776345476371209295180916"],"threshold":0.9},"id":"CVE-2026-102367-9601096c","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/ProdTag.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["308282593132653603774442944000802726557","152275842238481071334377665418150919899","11232567037795946619112874225186119058","101770132469175657616621679535154504512","37297662995804209606205392398127517367","97202307470797418456607080749927781007","136513966634841068054742010981418204232","14729314073850554449617528417899190119"],"threshold":0.9},"id":"CVE-2026-102367-9754a59d","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-sys/src/main/java/com/yami/shop/sys/model/SysRole.java"}},{"deprecated":false,"digest":{"line_hashes":["32943374781213760990766010512141100414","66505387459589569356006981138888715745","29121830017112458242384967661059469914","283167827742623297825875045917692166089","227250925930175198122470856223996099757","290290463424663559683092528460362331444","215636278406406280247026375646136676146","96150391788161201613308306652826238675","240982110923350533452635207441197127562","232864641877429372006488862929182134940","257009697670537390793751988660822352694","144836894086069350296775825786564423107","84662796593078326893196002317430600933","216429329622261991523682894208667085398","274760188978922383557575633833059036929","127960708872721994518461147572797622746","170653872581478075287830997777187039811"],"threshold":0.9},"id":"CVE-2026-102367-a0e20d9d","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/adapter/MallWebSecurityConfigurerAdapter.java"}},{"digest":{"threshold":0.9,"line_hashes":["216049816715719615514921474197044262115","77633660919566992078695833508494038860","172034049187200615513561570059307895648","108984741007882726017722598770897408600","308398276615095796451389573962139829482","267929605365746820268658832454877149334","245205212829190636923996254943573481231","239373525359387919896016885422873952183"]},"id":"CVE-2026-102367-a34fa017","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/UserCollection.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/Category.java"},"deprecated":false,"digest":{"line_hashes":["170172224404750739593639930669503865489","269338347931263041487404331048389078261","230965119339732759660095102588655348020","84440829490520795933501777265233606216"],"threshold":0.9},"id":"CVE-2026-102367-a58e4bda","signature_type":"Line"},{"target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/ProdProp.java"},"deprecated":false,"digest":{"line_hashes":["238599398720089304161423506447349593484","103259433584759310559484347680875870253","278839607862365852565083666447190071997","6304651884693683320042406262479135869","130697955646297447387621704654442373112","165629785668674846443906866175363318775","292993277036866162673860310351011349170","282225600283524634157787040148961878201"],"threshold":0.9},"id":"CVE-2026-102367-a69834a3","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae"},{"source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/UserAddr.java"},"deprecated":false,"digest":{"line_hashes":["132354286816338514454488482768326242045","145058926915464866456192048671259740338","205934240089247581048444838174482206521","249568071644532351322130096425676951187","18524052080168150292323898784265982533","29556397104365850820393262677842919197","320223749986774597689616988599244774237"],"threshold":0.9},"id":"CVE-2026-102367-ad126461","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["304620355501212156588851171715301460871","168891297852367452043978887195571100803"],"threshold":0.9},"id":"CVE-2026-102367-aef92661","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/MyOrderItemDto.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/ProdPropValue.java"},"deprecated":false,"digest":{"line_hashes":["172542124982409367390643620646121932490","59748505119757864526826089986550070354","218426012673885552234996048937490921024","154713539139740336697180722737385157543","175439024215587716439841400023033703183","338180580188831341999299324087248797374","195258023582725886932539195863361270203"],"threshold":0.9},"id":"CVE-2026-102367-b2795bef"},{"deprecated":false,"digest":{"line_hashes":["304620355501212156588851171715301460871","168891297852367452043978887195571100803","10695316654005116875961770282776455807","123414254493915838365702409943482620583","28437765685104550492784359714946810540","104383578165947816525692972724965564094","33347154866835222411207418813662225662","135450284319732494391570833481569764489"],"threshold":0.9},"id":"CVE-2026-102367-b3198b24","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/SkuDto.java"}},{"deprecated":false,"digest":{"line_hashes":["34392410626121516058530943868902858117","321690040681479456731471459681066029131","168891297852367452043978887195571100803"],"threshold":0.9},"id":"CVE-2026-102367-bc272d65","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/ProdCommDto.java"}},{"deprecated":false,"digest":{"function_hash":"26285742671774494722272961410715801377","length":177},"id":"CVE-2026-102367-bee1e2fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/util/Json.java","function":"toJsonString"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-admin/src/main/java/com/yami/shop/admin/controller/ProdCommController.java"},"deprecated":false,"digest":{"line_hashes":["311427082067284047029478078296629886161","137920542429536861889351934240659042256","103510659152712424800643303121582133484"],"threshold":0.9},"id":"CVE-2026-102367-c0327289"},{"source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/Notice.java"},"deprecated":false,"digest":{"line_hashes":["82113010221142541063461699340959246408","50534897015676397959509493876597731522","205934240089247581048444838174482206521","202958848831076701576459623010502659336","172400311080254621454479268877396918160","206846716141575347981650159544021929443","154024678845050241102924606240568734473"],"threshold":0.9},"id":"CVE-2026-102367-c388f951","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/User.java"},"deprecated":false,"digest":{"line_hashes":["83551807861501037584926975251999887717","50534897015676397959509493876597731522","205934240089247581048444838174482206521","19949611345289435190751599641358754579","159024571283313949542177834449658443246","208022896964032208621396948378890560842","138549378967914698585001066494711884760","220169485048651901457900208348211251387"],"threshold":0.9},"id":"CVE-2026-102367-c7ee03ea","signature_type":"Line"},{"source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/filter/AuthFilter.java"},"deprecated":false,"digest":{"line_hashes":["170816951571060875636601260752506838101","158864125561583775815450839089867419437","289170235437548692286889859244477652530","113953603053845971834565165619202597013","116295268231183902385997574251912633893"],"threshold":0.9},"id":"CVE-2026-102367-cb0460ed","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/TransfeeFree.java"},"deprecated":false,"digest":{"line_hashes":["105909337512462528253456832239116988748","76928437112356489734738929554694295802","292190886556722086470060735038155701701","227223939613560252206030471953056890069","58171899356725319887368101465545864472","165430501936278024308101277059726406164","103564719863697867313237972847683653498","48829704085751514217529969932586881550"],"threshold":0.9},"id":"CVE-2026-102367-cc37ab46"},{"target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/ShopCartItemDto.java"},"deprecated":false,"digest":{"line_hashes":["304620355501212156588851171715301460871","168891297852367452043978887195571100803","332141420746983287452269770097708213288","256616013166042480301744823603589402012","130441019161701041569445985492297964455","105806020708962975633999741324472412381","300671422190909498362192494995376038373","207784390102747196701519820560147336425","202731775657367034210343996102805364685","36998258253861336917786248181942798605"],"threshold":0.9},"id":"CVE-2026-102367-ccfa7976","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae"},{"deprecated":false,"digest":{"function_hash":"84854539216553177492401268332861701378","length":196},"id":"CVE-2026-102367-ce7293b2","signature_type":"Function","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/xss/XssWrapper.java","function":"getAttribute"}},{"deprecated":false,"digest":{"line_hashes":["304620355501212156588851171715301460871","168891297852367452043978887195571100803"],"threshold":0.9},"id":"CVE-2026-102367-cf3c1145","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/IndexImgDto.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/ProdTagReference.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["216049816715719615514921474197044262115","77633660919566992078695833508494038860","172034049187200615513561570059307895648","108984741007882726017722598770897408600","296147412929932652731110764671152769045","296100603619772112709184845549868000061","70251836122907705940704742368371557297","147419772830006022021915320374697362203"]},"id":"CVE-2026-102367-d21bff7b"},{"deprecated":false,"digest":{"line_hashes":["105909337512462528253456832239116988748","76928437112356489734738929554694295802","292190886556722086470060735038155701701","6329649621081259504409322103986877589","264639134628607633131167717946173550799","182123013449938094495929112931610514719","29505993579327223548991514901093702284","203881320162433272298120933686522284739"],"threshold":0.9},"id":"CVE-2026-102367-d33e92df","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/Transfee.java"}},{"deprecated":false,"digest":{"length":378,"function_hash":"154326765120279094986428182446841085191"},"id":"CVE-2026-102367-d7073f5f","signature_type":"Function","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/adapter/MallWebSecurityConfigurerAdapter.java","function":"filterChain"}},{"signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/Area.java"},"deprecated":false,"digest":{"line_hashes":["105909337512462528253456832239116988748","76928437112356489734738929554694295802","292190886556722086470060735038155701701","3264396203755044131533532936214668358","233741894824397582009047169604780578208","223006285116554368910183919532550650704","18153874405055477978520248406343085096"],"threshold":0.9},"id":"CVE-2026-102367-d844e279","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-common/src/main/java/com/yami/shop/common/config/RedisCacheConfig.java"},"deprecated":false,"digest":{"line_hashes":["246823188981971939269398278497590608953","137859232394428763282678285937157998624","139464201914128004868725625627586408329","263553643318542693169008601214750016915","39335036852747006829363257709035600850","279740499413153828999002254419961724458","212459109518408810275596752612027934823","250296793467462936751218517919644125825","329077704027228970460014076466817415756","292378120268717306007468947878378115778","318431918736029666634348320947621342771","281891563476150385274562148825946808871","221852499925484299951200124696641092740","240769926982575769736916093308040567376","69803567992983501686486320675722873826","121079260676954131762043488717586197377","111765342331142168648339797177069188290","146263268296006584873321235332209720703","107167011458428364595850915118797190403","199095337885723275580804472972829889247","46745100585661266261374465868423754927","209595050594754688565861747493500203660","231506109576117567140121383627769024401","191366124772524255499999629527718398190","153278312474071134802675965885767690299","166737724144449965654562636879563075996","5275144222023713077518024669604543575","157830414962571077258039778226447442892","327936571566039951810876728711627680265"],"threshold":0.9},"id":"CVE-2026-102367-dc2e1ce9","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-admin/src/main/java/com/yami/shop/admin/config/XxlJobConfig.java"},"deprecated":false,"digest":{"line_hashes":["103756694176078512207942820024676311674","270108456957571745743328826520616524056","299043552706768234573488693141727860636","212552654583098442078866537190904826454","16588985636654395341013877572639228606","295889375138396607956329520267553851739","12015191441710280533212142141782547381","3379032855983755667255647477758554032","21183623698843120563553261634325992987","236069149630129787075845587074847273920"],"threshold":0.9},"id":"CVE-2026-102367-df19bbd1"},{"deprecated":false,"digest":{"line_hashes":["144055157058886987942545591238999198941","327297196182523964961981826703599406781"],"threshold":0.9},"id":"CVE-2026-102367-efe9be7c","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/app/dto/ProductDto.java"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["172542124982409367390643620646121932490","98017927995834798881964566580575762711","290281817137846868905664377785984056050","233367603293819831524308359946815717042","39474640724379376039804981927468797851","152496739313212118783908842152898381216","81854970801679352675642856462233421528"]},"id":"CVE-2026-102367-f67690df","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-sys/src/main/java/com/yami/shop/sys/model/SysLog.java"}},{"id":"CVE-2026-102367-fbdf39bb","signature_type":"Line","signature_version":"v1","source":"https://github.com/gz-yami/mall4j/commit/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae","target":{"file":"yami-shop-bean/src/main/java/com/yami/shop/bean/model/IndexImg.java"},"deprecated":false,"digest":{"line_hashes":["170172224404750739593639930669503865489","269338347931263041487404331048389078261","230965119339732759660095102588655348020","84440829490520795933501777265233606216","10198737929313081990207056348826870282","290281817137846868905664377785984056050","78789637097246649405521841972692698005","215513932096726246268336018530437344902","230704392867133500001331217017974947251","179504713048775465266353140444335386124"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}