{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "4.4"
              },
              {
                "fixed": "4.4"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "DESCRIPTION"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "e34b4172b85c1fe4126e640c7f0309bb45b7aaf7"
            }
          ],
          "repo": "https://github.com/lilishop/lilishop",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
      "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110122.json"
  },
  "details": "PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.",
  "id": "CVE-2026-110122",
  "modified": "2026-10-15T02:30:31.715252200Z",
  "published": "2026-10-13T16:53:17.861Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110122.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/lilishop-seller-goods-cross-store-authz-bypass"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110122"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.vulncheck.com/advisories/pickmall-lilishop-through-4.4-idor-via-goods-freight-endpoint"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lilishop/lilishop"
    },
    {
      "type": "ARTICLE",
      "url": "https://github.com/lilishop/lilishop/blob/v4.4/framework/src/main/java/cn/lili/modules/goods/serviceimpl/GoodsServiceImpl.java#L424-L442"
    },
    {
      "type": "ARTICLE",
      "url": "https://github.com/lilishop/lilishop/blob/v4.4/seller-api/src/main/java/cn/lili/controller/goods/GoodsStoreController.java#L177-L185"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint"
}