CVE-2026-110122 Details

A vulnerability allowing insecure direct object reference has been identified in PickMall Lilishop versions through 4.4. This vulnerability enables authenticated sellers to modify product freight templates of other stores. The issue arises because the 'freight' update methods in 'GoodsServiceImpl' and 'GoodsSkuServiceImpl' lack store-specific checks, allowing sellers to apply their own freight templates to competitors' products and change shipping costs. The vulnerability is exploited through the 'PUT /store/goods/goods/freight' endpoint, where sellers can bind their own freight templates to products of other stores, altering the shipping cost model for those items.

The vulnerability can be fixed by implementing store ownership checks in the 'editGoods' method of 'GoodsServiceImpl' before any product modifications are made. Additionally, the 'freight' method should be updated to use the existing store-scoped update wrapper, ensuring that freight template changes are only applied to products within the seller's own store.