CVE-2026-105572
PickMall Lilishop Buyer Invoice List receipt authorization
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 6, 2026
- Updated
- Oct 6, 2026
- Reserved
- Oct 5, 2026
Description
A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
PickMall Lilishopn/a |
|
References
- VDB-413631 | PickMall Lilishop Buyer Invoice List receipt authorizationvdb-entrytechnical-description
- VDB-413631 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-105572 | CVE Analysis and Reportthird-party-advisory
- Submit #989312 | PickMall lilishop 4e6d563a4f0fa53880dd1420ce0904fc6e29f9e9 Missing Authorizationthird-party-advisory
- https://github.com/lilishop/lilishop/issues/149exploitissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.