CVE-2026-110122

Deferred Deferred - Pending Action

Authenticated Seller Access Bypass in PickMall lilishop

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110122

EUVD

EUVD-2026-98953

Affected Vendors & Products

Vendor	Product	Version / Range
PickMall	lilishop	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an insecure direct object reference in PickMall lilishop through version 4.4. It allows authenticated sellers to modify other stores' product freight templates via a specific API endpoint. The issue occurs because the system updates goods and SKUs by ID without checking if the seller belongs to the same store, enabling unauthorized changes to competitors' shipping charges.

Detection Guidance

To detect this vulnerability, monitor HTTP PUT requests to /store/goods/goods/update/{goodsId} or /store/goods/goods/freight endpoints. Check if requests from authenticated sellers modify products or freight templates belonging to other stores without proper authorization. Use network traffic analysis tools like Wireshark or tcpdump to inspect requests for missing store-scoped checks.

Impact Analysis

If you are a seller using PickMall lilishop, attackers could alter your shipping fees, making your products more expensive or cheaper than intended. This could lead to financial losses, unfair competition, or reputational damage. Customers might also face incorrect shipping costs, causing dissatisfaction.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized modifications to product data and freight templates. For GDPR, unauthorized changes to product information may violate data integrity principles (Article 5) and could lead to unauthorized processing of personal data. For HIPAA, if product data includes protected health information, unauthorized alterations could compromise confidentiality and integrity requirements.

Mitigation Strategies

Update PickMall lilishop to the latest version beyond 4.4 to ensure store-scoped checks are enforced during freight template updates.

Hi! I’m here to help you understand CVE-2026-110122. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70