CVE-2026-111348
mediumLikeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access…
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/likeadmin-likeshop/likeshop disclosure@vulncheck.com
- https://github.com/likeadmin-likeshop/likeshop/blob/3.5.1/server/application/api/controlle... disclosure@vulncheck.com
- https://github.com/likeadmin-likeshop/likeshop/blob/3.5.1/server/application/api/logic/Aft... disclosure@vulncheck.com
- https://hackmd.io/@hieuPenguinnn/likeshop-after-sale-api-cross-user-idor disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/likeshop-through-3.5.1-idor-via-aftersale-api-refund-... disclosure@vulncheck.com
- https://hackmd.io/@hieuPenguinnn/likeshop-after-sale-api-cross-user-idor 134c704f-9b21-4f2e-91b3-4a467353bcc0