PickMall Lilishop versions up to 4.4 are affected by an insecure direct object reference flaw that lets an authenticated seller edit any consignee’s product through the goods update endpoint. The vulnerability stems from the service accepting a goodsId without verifying that it belongs to the calling seller’s store, allowing an attacker to overwrite product details, change SKUs, and reassign the item to the attacker’s own store. This means an attacker can corrupt another vendor’s catalog, potentially leading to inventory mismanagement, revenue loss, and a breach of data integrity.

PickMall Lilishop 4.4 (both framework and seller‑api components). All deployments using the default configuration of these modules are vulnerable.

The CVSS score of 7.1 indicates a high‑severity risk. Exploitation requires a legitimate seller account capable of sending authenticated PUT requests to /store/goods/goods/update/{goodsId}. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. Nevertheless, the attack vector is network‑based and could be automated by any seller with administrative credentials, making the threat significant for multi‑tenant marketplaces that rely on Lilishop for product management.