CVE-2026-111647: Authorization Bypass Through User-Controlled Key in PickMall lilishop

CVE-2026-111647 describes an insecure direct object reference (IDOR) vulnerability in PickMall lilishop through version 5.0.0. The flaw exists in the ReceiptServiceImpl.getDetail function, which lacks an ownership check when retrieving invoice details. As a result, authenticated buyers can supply arbitrary receipt IDs to the GET /buyer/trade/receipt/{id} API endpoint and access invoice data belonging to other users. The exposed data includes invoice titles, taxpayer identification numbers, order numbers, member IDs, and member names, leading to unauthorized disclosure of sensitive buyer information.

The vulnerability allows authenticated users to bypass authorization controls and access sensitive invoice information of other buyers. This unauthorized data disclosure can lead to privacy violations and potential misuse of personal and financial information. The CVSS 4.0 base score is 5.3, indicating a medium severity impact due to network attack vector, low complexity, and no user interaction required.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint to trusted users only and monitor for suspicious access patterns. Implement additional access control checks to verify ownership of requested invoice records.