The vulnerability is an insecure direct object reference in PickMall lilishop 4.4 that allows an authenticated seller to change the freight templates assigned to products belonging to other stores by issuing a PUT request to /store/goods/goods/freight. The GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight functions update goods and SKUs solely based on an ID, without verifying that the requesting seller owns the target store, enabling the attacker to bind their own freight template to a competitor’s product and alter shipping charges. Based on the description, it is inferred that an attacker could manipulate shipping costs, potentially causing financial loss to the affected store.

PickMall lilishop version 4.4, accessed via its seller API. No other versions are known to be affected according to the supplied data.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The defect is exploitable by anyone with an authenticated seller account who can send a crafted HTTP PUT request to the freight endpoint. Because the endpoint lacks store‑scoped validation, the attacker can supply arbitrary freight identifiers and update freight rules for competitors’ products, leading to unauthorized financial manipulation.