# CVE-2026-10070: macrozheng mall improper authorization in Super Admin Password Handler

Source: https://junglewise.ai/threats/cve-2026-10070-macrozheng-mall-improper-authorization-in-super-admin-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-10070 · Severity: medium · CVSS 4.7 · Published 2026-05-29

macrozheng mall is an e-commerce platform used for managing online storefronts and backend operations. A security flaw in the administrative password handling component allows for improper authorization during updates. If exploited, an attacker could potentially manipulate administrative settings or credentials, leading to unauthorized access to the management system and sensitive business data.

Technologies: [Macrozheng Mall](https://junglewise.ai/threats/technologies/mall). Vendors: [Macrozheng](https://junglewise.ai/threats/vendors/macrozheng).

## Quick answers

**Is CVE-2026-10070 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10070 being exploited in the wild.

**How severe is CVE-2026-10070?** Medium severity, with a CVSS score of 4.7, published 29 May 2026.

**Which products and versions are affected?** Macrozheng Mall up to 1.0.3.

**Is there a fix for CVE-2026-10070?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10070 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10070?** Check whether you run Macrozheng Mall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authorization vulnerability (CWE-285/CWE-266) exists in macrozheng mall versions up to 1.0.3. The flaw is located within the Super Admin Password Handler component, specifically affecting the /admin/update/ endpoint. A remote attacker with high privileges can manipulate requests to this endpoint to bypass intended authorization controls. This could allow for unauthorized modification of administrative credentials or settings. The vendor has reportedly deleted the original issue report and has not provided a patch or official response.

## Affected products

- macrozheng mall up to 1.0.3

## Timeline

- 2026-05-29: advisory: NVD publication date

## References

- [https://github.com/macrozheng/mall/](https://github.com/macrozheng/mall/)
- [https://github.com/macrozheng/mall/issues/970](https://github.com/macrozheng/mall/issues/970)
- [https://vuldb.com/submit/818384](https://vuldb.com/submit/818384)
- [https://vuldb.com/vuln/367156](https://vuldb.com/vuln/367156)
- [https://vuldb.com/vuln/367156/cti](https://vuldb.com/vuln/367156/cti)

## Related threats

- [macrozheng mall business logic error in order generation](https://junglewise.ai/threats/cve-2026-109406-a-weakness-has-been-identified-in-macrozheng-mall-up-to-1-0-3)
- [macrozheng mall authentication bypass in JWT token refresh](https://junglewise.ai/threats/cve-2026-108785-a-flaw-has-been-found-in-macrozheng-mall-up-to-1-0-3-this-issue)
- [macrozheng mall payment business logic error in Alipay](https://junglewise.ai/threats/cve-2026-108784-a-vulnerability-was-detected-in-macrozheng-mall-up-to-1-0-3-this)
- [macrozheng mall authorization bypass in payment status endpoint](https://junglewise.ai/threats/cve-2026-82423-macrozheng-mall-authorization-bypass-in-payment-status-endpoint)
- [macrozheng mall race condition in order submission](https://junglewise.ai/threats/cve-2026-82364-macrozheng-mall-race-condition-in-order-submission)