Insecure Direct Object Reference in PickMall's lilishop Platform
CVE-2026-110121

7.1HIGH

Key Information:

Vendor

Pickmall

Status
Lilishop
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110121?

The PickMall lilishop platform, up to version 4.4, is susceptible to an insecure direct object reference (IDOR) vulnerability. This weakness enables authenticated sellers to maliciously exploit the goods update API endpoint by supplying valid goodsId values from other stores. As a result, attackers can execute PUT requests to manipulate and overwrite product details, SKUs, and effectively reassign products to their own stores. This flaw poses significant security risks, undermining the integrity of product ownership within the platform.

Affected Version(s)

lilishop 0 <= 4.4

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/lilishop-seller...
third-party-advisory
https://github.com/lilishop/lilishop/blob/v4.4/framework/...
technical-description
https://github.com/lilishop/lilishop/blob/v4.4/seller-api...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.