Medium severity · published Aug 29, 2026
CVE-2026-82364
macrozheng mall Order Submission submit race condition
4.2
CVSS
0.3%
EPSS
No
On KEV
Description
A security vulnerability has been detected in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /order/submit of the component Order Submission. The manipulation leads to race condition. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The vendor deleted the GitHub issue for this vulnerability without and explanation.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mall · macrozheng
1.0.0; 1.0.1; 1.0.2; 1.0.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82364
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82364
github.com
https://github.com/macrozheng/mall/
github.com
https://github.com/macrozheng/mall/issues/983
vuldb.com
https://vuldb.com/cve/CVE-2026-82364
vuldb.com
https://vuldb.com/submit/887361
vuldb.com
https://vuldb.com/vuln/396780
vuldb.com
https://vuldb.com/vuln/396780/cti
More from mall
9.1
CVE-2026-25858
macrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP Disclosure
8.1
CVE-2024-11619
macrozheng mall JWT Token default key
6.5
CVE-2026-108784
macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error
6.5
CVE-2025-13443
macrozheng mall delete access control
6.3
CVE-2026-108785
macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration