---
id: CVE-2026-110121
title: >-
  PickMall lilishop through 4.4 contains an insecure direct object reference
  vulnerability that allows authenticated sellers to overwrite any store's
  product by supplying another store's goodsId to the goods update endpoint
summary: >-
  PickMall lilishop through 4.4 contains an insecure direct object reference
  vulnerability that allows authenticated sellers to overwrite any store's
  product by supplying another store's goodsId to the goods update endpoint.
  Attackers can …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-639
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T18:17:22.830'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110121'
references:
  - url: >-
      https://github.com/lilishop/lilishop/blob/v4.4/framework/src/main/java/cn/lili/modules/goods/serviceimpl/GoodsServiceImpl.java#L198-L222
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/lilishop/lilishop/blob/v4.4/seller-api/src/main/java/cn/lili/controller/goods/GoodsStoreController.java#L143-L147
    label: disclosure@vulncheck.com
  - url: >-
      https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/lilishop-seller-goods-cross-store-authz-bypass
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/pickmall-lilishop-through-4.4-idor-via-goods-edit-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T17:38:53.190Z'
---

## Overview

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to replace product details and SKUs and reassign products to their own store.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.