There is a vulnerability about broken access control.

[yang8e]

[Suggested description]
There is a vulnerability that attacker can log into any user.

[Vulnerability Type]
Broken Access Control

[Vendor of Product]
https://github.com/newbee-ltd/newbee-mall

[Affected Product Code Base]
master

[Affected Component]
NewBeeMallUserServiceImpl.java

[Impact Information]
Escalation of Privileges

[Vulnerability proof]

1. register as a normal user
   

2. change userinfo and capture the request

3. change user_id at request body
   

4. send request and receive correspond userid's session

5. view user dashboard and receive correspond userid's information