CVE-2026-110121: PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated seller can exploit it. The attacker needs a goodsId belonging to another store and can submit a PUT request to /store/goods/goods/update/{goodsId}.
What can an attacker change?
The attacker can overwrite another store's product details and SKUs. They can also reassign the affected product to their own store.
Are unauthenticated users affected?
The provided information indicates that authentication as a seller is required. It does not indicate that unauthenticated users can exploit the endpoint.