Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111647PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id}

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in lilishop from PickMall. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers can supply another buyer's receipt id to GET /buyer/trade/receipt/{id} to obtain invoice titles, taxpayer identification numbers, order numbers, member ids and member names.

Affected products (as reported)

Vendor	Product	Versions
PickMall	lilishop	0 – through 5.0.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@hieuPenguinnn/lilishop-buyer-receipt-idor third-party-advisory
https://github.com/lilishop/lilishop/blob/5aa1c7ef04bb9178d8ddd535c3bbbd38a6fe1ccd/buyer-api/src/main/java/cn/lili/controller/order/ReceiptBuyerController.java#L33-L37 technical-description
https://github.com/lilishop/lilishop/blob/5aa1c7ef04bb9178d8ddd535c3bbbd38a6fe1ccd/framework/src/main/java/cn/lili/modules/order/order/serviceimpl/ReceiptServiceImpl.java#L40-L43 technical-description
https://github.com/lilishop/lilishop product
VulnCheck Advisory: PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id} third-party-advisory