CVE-2026-105572
Received Received - Intake

Authorization Bypass in PickMall Lilishop via memberId

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: VulDB

Description
A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-105572
EUVD
EUVD-2026-92930

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
n/a PickMall Lilishop 4.2.0
n/a PickMall Lilishop 4.2.1
n/a PickMall Lilishop 4.2.2
n/a PickMall Lilishop 4.2.3
n/a PickMall Lilishop 4.2.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the PickMall Lilishop e-commerce platform up to version 4.2.4. It allows authenticated buyers to access invoice records belonging to other members by manipulating the memberId parameter in the /buyer/trade/receipt endpoint. The issue occurs because the endpoint does not properly enforce member-level access control, enabling users to retrieve sensitive financial details such as taxpayer IDs, bank account information, and order statuses without authorization.

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to the /buyer/trade/receipt endpoint in PickMall Lilishop versions up to 4.2.4. Look for requests without a memberId parameter or with arbitrary memberId values. Check application logs for unauthorized access to invoice records or unusual data exposure patterns.

Impact Analysis

If you are a user of the affected Lilishop platform, an attacker could exploit this to access your sensitive invoice data, including financial information and order details. This could lead to identity theft, fraud, or misuse of your personal and financial data. The vulnerability allows remote exploitation without requiring advanced privileges.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by exposing sensitive personal and financial data without proper authorization. GDPR requires strict access controls for personal data, while HIPAA mandates protection of health-related financial information. The unauthorized access risk conflicts with these compliance requirements.

Mitigation Strategies

Immediately upgrade PickMall Lilishop to a version beyond 4.2.4 if available. If not, restrict access to the /buyer/trade/receipt endpoint via firewall rules. Ensure the memberId parameter is derived from the authenticated session and reject any client-supplied values. Monitor for unauthorized invoice access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105572. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart