CVE-2026-110122
MediumCVSS 4.3Summary
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.
Risk Assessment
Sellers can bind their own templates to competitors' products and alter shipping charges, potentially leading to unfair competition and incorrect fees for customers.
Recommendation
Add store ownership verification in freight update methods so sellers can only modify templates for their own products, and audit existing assignments.
Other vulnerabilities in PickMall lilishop
See all- CVE-2026-110121Medium
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.
- CVE-2026-105571High
A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the Mobile Binding component. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Original NVD description (English source)
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS