Quick answers
- Is CVE-2026-103539 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-103539 being exploited in the wild.
- How severe is CVE-2026-103539?
- Medium severity, with a CVSS score of 5.4, published 1 October 2026.
- Which products and versions are affected?
- ZongXR SuperMarket 1.0.0.0.
- Is there a fix for CVE-2026-103539?
- No fixed version is recorded yet. Remove the userName path parameter and retrieve the authenticated user from the security context using Authentication.getName() instead. Alternatively, validate that the userName in the path parameter matches the identity of the currently authenticated user before processing the purchase request. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-103539 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-103539?
- Check whether you run ZongXR SuperMarket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Remove the userName path parameter and retrieve the authenticated user from the security context using Authentication.getName() instead. Alternatively, validate that the userName in the path parameter matches the identity of the currently authenticated user before processing the purchase request.
Technical details
The InstantBuyController's startBuy endpoint accepts a userName path parameter without validating it against the authenticated user's identity, enabling privilege escalation. An attacker can invoke GET /instantbuy/manage/{itemId}/{arbitrary-username} to trigger purchase state changes (inventory decrement, Redis flag, database record insertion) for any victim username. The vulnerability affects the Instant Buy component across the controller, service, and message consumer layers, allowing manipulation of purchase eligibility and inventory records.
Affected products
- ZongXR SuperMarket 1.0.0.0
Timeline
- 2026-09-03: disclosed: Vulnerability reported via GitHub issue #30
- 2026-10-01: advisory: CVE-2026-103539 published