Likeshop CVE-2026-111348

Requires a valid authenticated session on the Likeshop instance (PR:L), which is readily obtainable because the platform supports customer self-registration - the only practical prerequisite. The attacker must reach the API after-sale endpoints (detail, goodsInfo, cancel, express, again in AfterSale.php) and supply another user's after-sale record id; no victim user interaction, no special non-default configuration, and no elevated privileges are needed. Limiting factors: exploitation is confined to after-sale/refund records, impact is read-and-modify of order/refund data rather than full account takeover, and the attacker must know or enumerate valid record ids belonging to other customers.

This is a genuine but moderate-severity authorization flaw, not a drop-everything emergency. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows a remotely reachable, low-complexity issue, but PR:L is the decisive limiter: exploitation requires an authenticated account. Since Likeshop allows self-registration, this authentication barrier is weak in practice - any attacker can obtain a valid low-privilege account and then abuse IDOR to cross customer boundaries. Impact is capped at VC:L/VI:L/VA:N: an attacker reads other customers' refund/order data and can tamper with after-sale workflows (cancel refunds, overwrite return shipment details, re-open refused refunds), but there is no confidentiality compromise of credentials, no code execution, and no availability impact. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no exploit-code flag is set, though a public technical write-up (hackmd) and exact vulnerable source lines on GitHub exist, which meaningfully lowers the research barrier for an attacker. Net: a legitimate access-control priority for Likeshop operators handling customer PII and refunds, but the limited technical impact and the open-source/niche footprint keep real-world systemic risk modest rather than critical.

An attacker self-registers a normal customer account on a Likeshop storefront, authenticates, and calls the after-sale API (detail, goodsInfo, cancel, express, again) while substituting another customer's after-sale record id. Because the endpoints in AfterSale.php/AfterSaleLogic.php do not verify record ownership, the attacker reads victims' refund and order data and tampers with their refund state. No exploit code is flagged in the input, but a public technical write-up documenting the flaw and the exact vulnerable source lines is referenced, so weaponization is low-effort.