CVE-2026-110121 Details

A vulnerability exists in PickMall Lilishop versions through 4.4, allowing authenticated sellers to overwrite products from other stores. This insecure direct object reference (IDOR) vulnerability is present in the seller API goods management module. By supplying a different store's goodsId to the goods update endpoint, sellers can replace product details and SKUs, and reassign the products to their own store. The vulnerability arises because the application does not properly enforce store-specific authorization when products are edited.

The vulnerability can be fixed by adding a store ownership check in the goods editing function and by scoping updates through the existing store-specific wrapper. This would align the edit functionality with the authorization checks already present in other parts of the application.