---
id: CVE-2026-111348
title: Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints
summary: >-
  Likeshop through 3.5.1 contains an insecure direct object reference
  vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated
  users access other customers' after-sale records by supplying their ids.
  Attackers with sel…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: likeshop
product: likeshop
affected:
  - likeshop <= 3.5.1
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:43:39.350Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111348'
references:
  - url: 'https://hackmd.io/@hieuPenguinnn/likeshop-after-sale-api-cross-user-idor'
  - url: >-
      https://github.com/likeadmin-likeshop/likeshop/blob/3.5.1/server/application/api/controller/AfterSale.php#L52-L102
  - url: >-
      https://github.com/likeadmin-likeshop/likeshop/blob/3.5.1/server/application/api/logic/AfterSaleLogic.php#L251-L377
  - url: 'https://github.com/likeadmin-likeshop/likeshop'
  - url: >-
      https://www.vulncheck.com/advisories/likeshop-through-3.5.1-idor-via-aftersale-api-refund-endpoints
    label: >-
      VulnCheck Advisory: Likeshop through 3.5.1 IDOR via AfterSale API Refund
      Endpoints
tags:
  - cve.org
ingestedAt: '2026-10-15T22:48:25.455Z'
---

## Overview

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.

## Affected

- `likeshop <= 3.5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.