CVE-2026-111348
MediumCVSS 5.4Summary
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
Risk Assessment
Authenticated users can access and modify other customers' after-sale data, leading to confidentiality and integrity breaches.
Recommendation
Update Likeshop to a version later than 3.5.1 if available, or implement authorization checks for after-sale actions.
Other vulnerabilities in Likeshop
Original NVD description (English source)
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS