This vulnerability is an insecure direct object reference that allows an authenticated buyer to view invoice records that belong to other buyers. The affected method, ReceiptServiceImpl.getDetail, omits an ownership check, making it possible to retrieve invoice titles, taxpayer identification numbers, order numbers, member IDs and member names simply by supplying another buyer's receipt ID on the GET /buyer/trade/receipt/{id} endpoint. The impact is a disclosure of confidential customer data and transaction details.

The product impacted is PickMall Lilishop, in all releases through version 5.0.0. Any deployed instance of Lilishop claimed to be using a 5.0.0 or earlier release is vulnerable unless the code has been patched to perform ownership checks.

The CVSS score of 5.3 indicates medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated as a buyer to exploit the IDOR; the vulnerability is therefore only exploitable within the context of a legitimate user session. Because the endpoint returns sensitive personal and transactional information, a successful exploit results in confidential data disclosure.