CVE-2026-110122: Authorization Bypass Through User-Controlled Key in PickMall lilishop

PickMall lilishop through version 4.4 contains an insecure direct object reference vulnerability (CVE-2026-110122) that permits authenticated sellers to change freight templates of products belonging to other stores. The vulnerability exists in the GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update methods, which update goods and SKUs by ID without verifying that the requesting seller owns the store. This lack of store-scoped authorization checks enables sellers to bind their own freight templates to competitors' products and alter shipping fees.

An authenticated seller can manipulate the shipping charges of products from other stores by changing their freight templates. This could lead to unfair competitive advantages or disruption of normal commerce operations within the platform. There is no indication of data disclosure or system compromise beyond unauthorized freight template modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict seller permissions and monitor for unauthorized freight template changes. Vendors should implement proper store ownership checks in the update methods to prevent unauthorized modifications.