CVE-2026-111647
Received Received - Intake

Authenticated Buyer Access to Other Buyers' Invoice Data in PickMall lilishop

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers can supply another buyer's receipt id to GET /buyer/trade/receipt/{id} to obtain invoice titles, taxpayer identification numbers, order numbers, member ids and member names.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111647
EUVD
EUVD-2026-103069

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
PickMall lilishop 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an insecure direct object reference (IDOR) in PickMall lilishop through version 5.0.0. It allows authenticated buyers to access other buyers' invoice records without proper authorization checks. Specifically, the ReceiptServiceImpl.getDetail function fails to verify ownership, enabling attackers to manipulate receipt IDs in the GET /buyer/trade/receipt/{id} endpoint to retrieve sensitive invoice details such as titles, taxpayer IDs, order numbers, member IDs, and names.

Detection Guidance

To detect this vulnerability, monitor access logs for GET requests to /buyer/trade/receipt/{id} with varying IDs. Check if authenticated buyers can retrieve invoice details not belonging to them. Use tools like curl to test endpoints with different receipt IDs and verify if unauthorized data is exposed.

Impact Analysis

If you are a user of PickMall lilishop, an attacker could exploit this to access your or other users' invoice data, leading to privacy breaches, identity theft, or financial fraud. For businesses, this could result in reputational damage, legal liabilities, and loss of customer trust due to exposed sensitive information.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personally identifiable information (PII) and protected health information (PHI) without authorization. GDPR requires strict data protection and user consent, while HIPAA mandates safeguards for health-related data. Non-compliance could lead to fines, legal actions, and mandatory breach notifications.

Mitigation Strategies

Immediately update PickMall lilishop to the latest version beyond 5.0.0. Implement strict ownership checks in ReceiptServiceImpl.getDetail to ensure users can only access their own invoice records. Restrict direct object references by validating user permissions before data retrieval.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111647. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart