CVE-2026-111647 PickMall CVE debrief

Who should care

Defenders responsible for PickMall lilishop deployments should assess their exposure and prioritize remediation. This includes reviewing the version of lilishop in use, implementing proper access controls, and monitoring for potential exploitation attempts.

Why it matters

CVE-2026-111647 is a medium-severity vulnerability in PickMall lilishop that allows authenticated buyers to read other buyers' invoice records. Defenders should prioritize verifying the presence of this vulnerability in their inventory and implementing proper access controls to prevent unauthorized data disclosure.

• Authenticated buyers can access sensitive information belonging to other buyers.
• The vulnerability allows for unauthorized data disclosure.
• Defenders need to verify the presence of this vulnerability in their inventory.
• Remediation priority is high due to the potential for data exposure.

Technical summary

The vulnerability exists in the ReceiptServiceImpl.getDetail method, which does not perform an ownership check. This allows authenticated buyers to read other buyers' invoice records by manipulating the receipt ID in the URL /buyer/trade/receipt/{id}. The issue enables attackers to obtain sensitive information such as invoice titles, taxpayer identification numbers, order numbers, member IDs, and member names. Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact on their systems.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory and assessing the potential impact on their systems.

Recommended defensive actions

• Verify the version of PickMall lilishop in use and assess if it is vulnerable (version 5.0.0 or earlier).
• Implement proper access controls and ownership checks in the ReceiptServiceImpl.getDetail method to prevent unauthorized access to invoice records.
• Monitor for potential exploitation attempts and adjust detection rules as necessary.
• Perform a thorough review of the system to identify potential entry points for attackers.
• Check for any existing compensating controls that could mitigate the vulnerability.
• Review and update asset inventory to ensure accurate tracking of affected systems.
• Implement additional monitoring to detect potential exploitation attempts.

Evidence notes

The vulnerability is confirmed to exist in PickMall lilishop through version 5.0.0. The ReceiptServiceImpl.getDetail method does not perform an ownership check, allowing authenticated buyers to access other buyers' invoice records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.