{"id":"CVE-2026-111647","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-111647","generatedAt":"2026-10-28T03:42:02.767Z","title":"PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check.","description":"PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers can supply another buyer's receipt id to GET /buyer/trade/receipt/{id} to obtain invoice titles, taxpayer identification numbers, order numbers, member ids and member names.","published":"2026-10-16T18:17:46.000Z","lastModified":"2026-10-16T20:17:22.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":5.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-639"],"affected":[],"epss":{"score":0.00315,"percentile":0.24298,"date":"2026-10-27","history":[{"date":"2026-10-17","score":0.00315,"percentile":0.2289}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-16T18:17:46.000Z","detail":{"score":"5.3","severity":"MEDIUM","publishedAt":"2026-10-16T18:17:45.597Z"},"summary":"New CVE, medium severity (CVSS 5.3)."}],"references":[{"url":"https://github.com/lilishop/lilishop","source":"disclosure@vulncheck.com"},{"url":"https://github.com/lilishop/lilishop/blob/5aa1c7ef04bb9178d8ddd535c3bbbd38a6fe1ccd/buyer-api/src/main/java/cn/lili/controller/order/ReceiptBuyerController.java#L33-L37","source":"disclosure@vulncheck.com"},{"url":"https://github.com/lilishop/lilishop/blob/5aa1c7ef04bb9178d8ddd535c3bbbd38a6fe1ccd/framework/src/main/java/cn/lili/modules/order/order/serviceimpl/ReceiptServiceImpl.java#L40-L43","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@hieuPenguinnn/lilishop-buyer-receipt-idor","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/pickmall-lilishop-through-5.0.0-idor-via-buyer-trade-receipt-id","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@hieuPenguinnn/lilishop-buyer-receipt-idor","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-111647","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}