CVE-2026-111647 Details

A cross-buyer insecure direct object reference (IDOR) vulnerability has been identified in PickMall lilishop versions through 5.0.0. This vulnerability allows authenticated buyers to access and read invoice records of other buyers. The issue arises because the 'ReceiptServiceImpl.getDetail' method lacks proper ownership verification. Exploitation involves supplying a receipt ID belonging to another buyer into the 'GET /buyer/trade/receipt/{id}' endpoint, which then returns sensitive invoice details such as invoice titles, taxpayer identification numbers, order numbers, member IDs, and member names.

The vulnerability can be fixed by adding ownership checks to the invoice retrieval methods in the 'ReceiptBuyerController'. This involves wrapping the responses in an authorization check that compares the invoice's member ID to the ID of the authenticated buyer making the request. Additionally, the collection endpoint should be modified to automatically include the current buyer's ID in the search parameters, ensuring that only invoices belonging to the buyer are returned.