CVE-2026-110122
mediumPickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product frei…
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/lilishop/lilishop/blob/v4.4/framework/src/main/java/cn/lili/modules/goo... disclosure@vulncheck.com
- https://github.com/lilishop/lilishop/blob/v4.4/seller-api/src/main/java/cn/lili/controller... disclosure@vulncheck.com
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/lilishop-seller-goods-cross-store-authz-bypass disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/pickmall-lilishop-through-4.4-idor-via-goods-freight-... disclosure@vulncheck.com
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/lilishop-seller-goods-cross-store-authz-bypass 134c704f-9b21-4f2e-91b3-4a467353bcc0