CVE-2026-105572 - Vulnerability Details

- PickMall Lilishop Buyer Invoice List receipt authorization

Description

A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Published: 2026-10-06

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A vulnerability exists in PickMall Lilishop up to version 4.2.4 where an unknown function in the /buyer/trade/receipt component allows an attacker to manipulate the memberId parameter. This manipulation leads to an authorization bypass, enabling the attacker to view or otherwise access sensitive buyer invoice data without proper authentication. The flaw is categorized as CWE-285 (Authorization Bypass Through Privilege Escalation) and CWE-639 (Authorization Bypass Through User-Controlled Search Failure).

Affected Systems

The affected product is PickMall Lilishop, specifically releases up to and including version 4.2.4. The flaw resides in the Buyer Invoice List receipt functionality and requires the victim to run one of the vulnerable releases.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely by sending crafted requests to the receipt endpoint. Because the flaw is publicly disclosed and the project has not released a fix, the risk of exploitation remains significant until remediation is applied.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

PickMall Lilishop

affected

Version	Status	Constraints
`4.2.0`	affected	—
`4.2.1`	affected	—
`4.2.2`	affected	—
`4.2.3`	affected	—
`4.2.4`	affected	—

No data.

Vendor Product Confidence Versions

Pickmall

Lilishop

89%

Version	Status	Scheme	Platform
`4.2.0`	affected	semver	—
`4.2.1`	affected	semver	—
`4.2.2`	affected	semver	—
`4.2.3`	affected	semver	—
`4.2.4`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check whether the PickMall Lilishop installation is version 4.2.4 or earlier and whether the /buyer/trade/receipt endpoint is publicly accessible.
Upgrade to a patched release (4.2.5 or later) once the vendor publishes a fix.
If an immediate upgrade is not available, restrict or lock down the /buyer/trade/receipt endpoint by enforcing authentication, IP restrictions, or firewall rules to prevent unauthorized manipulation of memberId.
Monitor application logs for abnormal or unauthorized requests to the receipt endpoint and investigate any suspicious activity.

Generated by OpenCVE AI on October 6, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00223.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/lilishop/lilishop/issues/149
https://vuldb.com/cve/CVE-2026-105572
https://vuldb.com/submit/989312
https://vuldb.com/vuln/413631
https://vuldb.com/vuln/413631/cti

History

Tue, 06 Oct 2026 20:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Pickmall Pickmall lilishop
Vendors & Products		Pickmall Pickmall lilishop

Tue, 06 Oct 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 06 Oct 2026 02:45:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title		PickMall Lilishop Buyer Invoice List receipt authorization
First Time appeared		Pickmall Lilishop Pickmall Lilishop pickmall Lilishop
Weaknesses		CWE-285 CWE-639
CPEs		cpe:2.3:a:pickmall_lilishop:pickmall_lilishop::::::::
Vendors & Products		Pickmall Lilishop Pickmall Lilishop pickmall Lilishop
References		https://github.com/lilishop/lilishop/issues/149 https://vuldb.com/cve/CVE-2026-105572 https://vuldb.com/submit/989312 https://vuldb.com/vuln/413631 https://vuldb.com/vuln/413631/cti
Metrics		cvssV2_0 `{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C'}` cvssV3_0 `{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Pickmall Lilishop

Pickmall Lilishop Pickmall Lilishop

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-06T02:30:15.772Z

Updated: 2026-10-06T13:18:52.036Z

Reserved: 2026-10-05T16:09:37.161Z

Link: CVE-2026-105572

Vulnrichment

Updated: 2026-10-06T13:18:46.835Z

NVD

Status : Deferred

Published: 2026-10-06T03:17:00.827

Modified: 2026-10-06T15:04:52.637

Link: CVE-2026-105572

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-06T20:30:05Z

Weaknesses

CWE-285
Improper Authorization
CWE-639
Authorization Bypass Through User-Controlled Key

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object