CVE-2026-111348
CVE-2026-111348 · Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.
CVSS 5.3 · Medium · EPSS 0.3%
- Published
- Updated
Affected products and versions
likeshop
- Versions
- ≥ 0, ≤ 3.5.1: Affected (custom)
No fix published
Original sources
- https://hackmd.io/@hieuPenguinnn/likeshop-after-sale-api-cross-user-idor
- https://github.com/likeadmin-likeshop/likeshop/blob/3.5.1/server/application/api/controller/AfterSale.php#L52-L102
- https://github.com/likeadmin-likeshop/likeshop/blob/3.5.1/server/application/api/logic/AfterSaleLogic.php#L251-L377
- https://github.com/likeadmin-likeshop/likeshop
- https://www.vulncheck.com/advisories/likeshop-through-3.5.1-idor-via-aftersale-api-refund-endpoints
- https://nvd.nist.gov/vuln/detail/CVE-2026-111348