CVE-2026-111348: Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user, including an attacker using a self-registered account, can exploit it by supplying identifiers for other customers' after-sale records. No user interaction is required.
What actions are exposed through the affected API?
The detail and goodsInfo actions can disclose refund and order information. The cancel, express, and again actions can cancel refunds, overwrite return-shipment details, and re-open refused refunds.
How can I determine whether my deployment is affected?
Deployments running Likeshop through version 3.5.1 are affected. A practical check is to authenticate as one customer and attempt the AfterSale detail, goodsInfo, cancel, express, or again actions using an after-sale record ID belonging to another customer.