Gz-yami - Mall4j - CRITICAL - CVE-2026-102361. The mall4j software, up to version 4.0, contains a security flaw where the PUT /user/updatePwd endpoint lacks proper authentication mechanisms. This allows malicious actors to reset passwords of any storefront account simply by providing the target username in the request body, bypassing any necessary validation. Such a vulnerability could lead to unauthorized access to sensitive user data, including personal information and order histories, making it imperative for users to apply necessary mitigations. BADGES: 👾 EXPLOITED | 🟡 PoC | SecurityVulnerability.io