CVE-2026-110121

6.5Medium

Published 13 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity
Weakness: CWE-639

Impact

Authenticated sellers can overwrite arbitrary products, modify SKUs, and reassign goods to their own store. An attacker only needs a standard seller account and network access to the API.

Root cause

The goods update endpoint lacks authorization checks to verify that the target goodsId belongs to the authenticated seller's store before applying changes.

Affected systems

PickMall lilishop through 4.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Fix & remediation

Fixed version is not listed; check the vendor repository for patches after version 4.4. As an interim mitigation, restrict or block PUT requests to /store/goods/goods/update/* at the API gateway or reverse proxy for untrusted seller accounts.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110121