Insecure Direct Object Reference in Likeshop Allows Unauthorized Access to After-Sale Records

CVE-2026-111348

What is CVE-2026-111348?

The Likeshop product version 3.5.1 suffers from an insecure direct object reference vulnerability allowing authenticated users to access the after-sale records of other customers by providing their IDs. This flaw permits attackers with self-registered accounts to exploit various functionalities such as retrieving refund and order information, canceling refunds, modifying return shipment details, and re-opening denied refunds. The vulnerability arises in the AfterSale.php and AfterSaleLogic.php files, exposing sensitive data that could significantly compromise user privacy and overall application security.

References