CVE-2026-10070

Vulnerability

The vulnerability exists in the super admin password handler at /admin/update/ in macrozheng mall versions up to and including 1.0.3 [1]. The endpoint fails to properly verify authorization, allowing unauthenticated manipulation of the admin password [2].

Exploitation

An attacker can exploit the flaw remotely by sending crafted HTTP requests to /admin/update/ without requiring authentication or user interaction. The exact payload details are not publicly disclosed, but the attack vector is network-based [2].

Impact

Successful exploitation enables an attacker to change the super admin password, gaining full administrative control over the mall system. This leads to unauthorized access to sensitive data, configuration changes, and potential service disruption [1].

Mitigation

No official fix has been released; the vendor deleted the associated GitHub issue and did not respond to disclosure [2]. Users should restrict network access to the /admin/update/ endpoint or implement additional authorization checks, such as requiring current password confirmation [1].