CVE-2026-105572: PickMall Lilishop Buyer Invoice List receipt authorization
A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs low-privileged access, as indicated by the required privileges metric. Exploitation can be performed remotely and does not require user interaction.
Which deployments may be affected?
PickMall Lilishop versions up to 4.2.4 may be affected. The issue is associated with the Buyer Invoice List component and the /buyer/trade/receipt endpoint.
What is the likely impact of successful exploitation?
Manipulating the memberId argument can bypass authorization checks. The stated impact is limited to confidentiality, with no reported integrity or availability impact.
Is there evidence that exploitation is practical?
A public exploit has been disclosed and may be used. This makes exposed, low-privilege accounts a relevant triage concern.
Is a vendor fix available?
The available information does not identify a fix. It states that the project was notified through an issue report but had not responded at the time of disclosure.