Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-110122PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in lilishop from PickMall. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 84.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.

Affected products (as reported)

Vendor	Product	Versions
PickMall	lilishop	0 – through 4.4

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/lilishop-seller-goods-cross-store-authz-bypass third-party-advisory
https://github.com/lilishop/lilishop/blob/v4.4/framework/src/main/java/cn/lili/modules/goods/serviceimpl/GoodsServiceImpl.java#L424-L442 technical-description
https://github.com/lilishop/lilishop/blob/v4.4/seller-api/src/main/java/cn/lili/controller/goods/GoodsStoreController.java#L177-L185 technical-description
VulnCheck Advisory: PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint third-party-advisory