CVE-2026-110122: PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated seller can exploit it. The seller does not need elevated administrative privileges, but can target products belonging to other stores.
What access and endpoint are required for exploitation?
The attacker needs seller authentication and must send a PUT request to /store/goods/goods/freight. The vulnerable update paths use goods and SKU identifiers without validating that the targeted records belong to the seller's store.
What is the practical impact of a successful attack?
A malicious seller can bind freight templates they control to competitors' products. This can alter shipping charges for those products.