CVE-2026-110122
4.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-639
Impact
Authenticated sellers can modify shipping templates on competitors' goods to tamper with customer shipping charges. They need an active seller account and network access to the API.
Root cause
The freight update endpoints in GoodsServiceImpl and GoodsSkuServiceImpl query goods and SKUs solely by ID without verifying the caller's store ownership.
Affected systems
PickMall lilishop through 4.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Fix & remediation
No fixed version is currently documented; patch GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight to enforce store ID checks against the authenticated user, or block the PUT /store/goods/goods/freight route at the API gateway until fixed.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.
References
- https://github.com/lilishop/lilishop/blob/v4.4/framework/src/main/java/cn/lili/modules/goods/serviceimpl/GoodsServiceImpl.java#L424-L442
- https://github.com/lilishop/lilishop/blob/v4.4/seller-api/src/main/java/cn/lili/controller/goods/GoodsStoreController.java#L177-L185
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/lilishop-seller-goods-cross-store-authz-bypass
- https://www.vulncheck.com/advisories/pickmall-lilishop-through-4.4-idor-via-goods-freight-endpoint