CVE-2026-110121
MediumCVSS 6.5Summary
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.
Risk Assessment
Sellers can take over other stores' products, modify their data, and reassign them to themselves, leading to loss of control over inventory and potential business losses.
Recommendation
Implement store ownership checks in the product update endpoint so sellers can only edit their own products, and verify the integrity of product-to-store assignments.
Other vulnerabilities in PickMall lilishop
See all- CVE-2026-110122Medium
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.
- CVE-2026-105571High
A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the Mobile Binding component. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS