CVE-2026-111348

Received Received - Intake

Insecure Direct Object Reference in Likeshop After-Sale Module

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111348

Affected Vendors & Products

Vendor	Product	Version / Range
likeshop	likeshop	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Likeshop through version 3.5.1 has an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php. This flaw allows authenticated users to access other customers' after-sale records by providing their IDs. Attackers with self-registered accounts can exploit this to perform actions like reading refund and order data, canceling refunds, overwriting return shipment details, or reopening refused refunds.

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to AfterSale.php or AfterSaleLogic.php with parameters like detail, goodsInfo, cancel, express, or again. Check for unauthorized access to other users' after-sale records by monitoring for requests with manipulated IDs.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive customer data, including refunds and order information. Attackers may cancel refunds, alter return shipment details, or reopen refused refunds, causing financial losses or operational disruptions for affected users.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personal and sensitive customer data without authorization. GDPR requires protecting personal data, while HIPAA mandates safeguarding health-related information. The breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update Likeshop to version 3.5.2 or later. Implement strict access controls to prevent unauthorized access to after-sale records. Review and restrict user permissions to ensure only authorized actions are permitted.

Hi! I’m here to help you understand CVE-2026-111348. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70