CVE-2026-111348 likeshop CVE debrief

Who should care

Defenders responsible for Likeshop deployments should assess exposure and verify the vulnerability in their environments. This includes checking for the presence of vulnerable files and ensuring appropriate access controls. Security teams should also monitor for suspicious activity related to after-sale records.

Why it matters

CVE-2026-111348 is a medium-severity vulnerability in Likeshop that allows authenticated users to access sensitive after-sale records of other customers. Defenders should assess exposure, verify the vulnerability, and prioritize patching or mitigation to prevent unauthorized access and potential data breaches.

• Authenticated users can access sensitive after-sale records of other customers
• Attackers can read refund and order data, cancel refunds, or modify return shipment details
• Verification of vulnerability presence and exposure in Likeshop deployments is necessary
• Defenders should prioritize patching or mitigating the vulnerability to prevent unauthorized access

Technical summary

The vulnerability exists in the AfterSale.php and AfterSaleLogic.php files of Likeshop through version 3.5.1. It allows authenticated users to access other customers' after-sale records by supplying their IDs. Attackers with self-registered accounts can perform various actions, including reading refund and order data, canceling refunds, overwriting return shipment details, or re-opening refused refunds.

Defensive priority

Defenders should prioritize verifying the vulnerability in Likeshop versions up to 3.5.1 and assessing exposure in their environments. This involves checking for the presence of the vulnerable files (AfterSale.php and AfterSaleLogic.php) and ensuring that appropriate access controls are in place.

Recommended defensive actions

• Verify the presence of vulnerable files (AfterSale.php and AfterSaleLogic.php) in Likeshop versions up to 3.5.1
• Assess exposure in environments using Likeshop
• Ensure appropriate access controls are in place for after-sale records
• Monitor for suspicious activity related to after-sale records
• Perform a thorough review of Likeshop deployment configurations to identify potential vulnerabilities
• Implement additional logging and monitoring to detect potential exploitation attempts
• Review and update incident response plans to address potential impacts of this vulnerability

Evidence notes

The vulnerability is confirmed to exist in Likeshop version 3.5.1. The CVE record and NVD entry provide details about the vulnerability, including its CVSS score of 5.3 and severity of MEDIUM. However, the exact scope of affected versions and potential impact on various deployment contexts require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.