Insecure Direct Object Reference in PickMall lilishop Software
CVE-2026-110122

5.3MEDIUM

Key Information:

Vendor

Pickmall

Status
Lilishop
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110122?

The PickMall lilishop software, specifically version 4.4, is susceptible to an insecure direct object reference vulnerability. This flaw permits authenticated sellers to modify freight templates associated with other stores. Through the endpoint PUT /store/goods/goods/freight, sellers can exploit this vulnerability to bind their own freight templates to competing products, thus having the ability to change shipping charges. This lack of store-scoped checks in the GoodsServiceImpl and GoodsSkuServiceImpl implementations underscores the potential for serious exploitation of this issue.

Affected Version(s)

lilishop 0 <= 4.4

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/lilishop-seller...
third-party-advisory
https://github.com/lilishop/lilishop/blob/v4.4/framework/...
technical-description
https://github.com/lilishop/lilishop/blob/v4.4/seller-api...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.