CVE-2026-111647
CVE-2026-111647 · PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id}
This page contains facts from public vulnerability sources. Check the original advisory before updating.
PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers can supply another buyer's receipt id to GET /buyer/trade/receipt/{id} to obtain invoice titles, taxpayer identification numbers, order numbers, member ids and member names.
CVSS 5.3 · Medium · EPSS 0.3%
- Published
- Updated
Affected products and versions
lilishop
- Versions
- ≥ 0, ≤ 5.0.0: Affected (custom)
No fix published
Original sources
- https://hackmd.io/@hieuPenguinnn/lilishop-buyer-receipt-idor
- https://github.com/lilishop/lilishop/blob/5aa1c7ef04bb9178d8ddd535c3bbbd38a6fe1ccd/buyer-api/src/main/java/cn/lili/controller/order/ReceiptBuyerController.java#L33-L37
- https://github.com/lilishop/lilishop/blob/5aa1c7ef04bb9178d8ddd535c3bbbd38a6fe1ccd/framework/src/main/java/cn/lili/modules/order/order/serviceimpl/ReceiptServiceImpl.java#L40-L43
- https://github.com/lilishop/lilishop
- https://www.vulncheck.com/advisories/pickmall-lilishop-through-5.0.0-idor-via-buyer-trade-receipt-id
- https://nvd.nist.gov/vuln/detail/CVE-2026-111647