CVE-2026-110122 — PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via …
Published: 2026-10-13 · CVSS: 5.3 · CVSS 4.0
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7