PickMall Lilishop CVE-2026-105572

Requires a valid authenticated buyer account on the Lilishop storefront (PR:L); no user interaction is needed. The specific trigger is manipulation of the memberId argument on the /buyer/trade/receipt endpoint of the Buyer Invoice List component, which fails to enforce per-member ownership. Limiting factors: the attacker must first hold a buyer-level session, impact is confined to reading other members' invoice/receipt data (no write or service impact), and only Lilishop deployments at version 4.2.4 or earlier are affected. No fixed version is currently available because the vendor has not responded.

This is a moderate, authenticated information-disclosure (IDOR/authorization-bypass, CWE-639) issue that does not warrant emergency prioritization despite its public exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reach and low complexity but requires an authenticated buyer account (PR:L), and impact is limited to low confidentiality (VC:L) with no integrity or availability effect (VI:N/VA:N) - consistent with the 5.3 (Medium) score. Exploitation status is 'publicly available exploit code exists' (VulDB disclosure plus the linked GitHub issue, E:P); there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of active, widespread exploitation - public POC availability and active exploitation are distinct signals. No EPSS value is provided, so exploitation-probability cannot be quantified from the data. The signals are internally consistent (network vector, low privilege, low-confidentiality impact), with no CVSS-vs-description conflict. Net: a real but low-severity authorization flaw in a niche open-source platform whose vendor has not yet responded, making it a patch-management/monitoring item rather than a drop-everything priority.

An attacker who holds a legitimate low-privilege buyer account on a Lilishop store (≤4.2.4) sends a request to /buyer/trade/receipt while tampering with the memberId parameter to reference another buyer. Because the endpoint fails to verify ownership, the attacker retrieves another member's invoice/receipt (Buyer Invoice List) data. Public exploit details have been disclosed via VulDB and the project's GitHub issue tracker, lowering the effort required.