[security vulnerability] Arbitrary Address Deletion Vulnerability

[GatekeeperBuster]

Recently, our team found an arbitrary address deletion vulnerability in the latest version of the project.

The vulnerability logic is present in the file: https://github.com/youlaitech/youlai-mall/blob/master/mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/AddressController.java#L63.

The operation addressService.removeByIds() is not protected by permission checks,
which allows a regular user to delete any users' addresses through a customized request to
DELETE /app-api/v1/addresses/{ids}.

To address this vulnerability, we strongly advise that developers implement access control policies that limit API access to admin users or the owner of the address.