Is CVE-2026-105572 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105572 being exploited in the wild.

How severe is CVE-2026-105572?

Medium severity, with a CVSS score of 4.3, published 6 October 2026.

How is CVE-2026-105572 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105572?

Check whether you run PickMall Lilishop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105572: PickMall Lilishop authorization bypass in buyer invoice list

CVE-2026-105572 · Severity: medium · CVSS 4.3 · Published 2026-10-06

Lilishop is an e-commerce platform that manages buyer accounts and invoicing. An authorization flaw in the invoice listing feature allows any authenticated buyer to view other members' invoices, exposing sensitive financial details including taxpayer IDs, bank account information, and company addresses. The vulnerability can be exploited remotely by any registered user without additional interaction.

Technologies: PickMall Lilishop. Vendors: PickMall.

Quick answers

Is CVE-2026-105572 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105572 being exploited in the wild.
How severe is CVE-2026-105572?: Medium severity, with a CVSS score of 4.3, published 6 October 2026.
Which products and versions are affected?: PickMall Lilishop up to 4.2.4.
Is there a fix for CVE-2026-105572?: No fixed version is recorded yet. Set the member identifier from the authenticated session in the invoice-list controller and reject any client-supplied memberId parameter, mirroring the access control pattern used in sibling buyer list handlers for orders and coupons.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105572 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105572?: Check whether you run PickMall Lilishop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Set the member identifier from the authenticated session in the invoice-list controller and reject any client-supplied memberId parameter, mirroring the access control pattern used in sibling buyer list handlers for orders and coupons.</anigation> </invoke>

Technical details

The /buyer/trade/receipt endpoint fails to scope query results to the authenticated user's member identifier, instead accepting an optional client-supplied memberId parameter that overrides access controls. The vulnerable component (Buyer Invoice List) forwards search parameters unchanged to the service layer without binding the authenticated session's member ID, allowing enumeration of arbitrary members' invoice records or selection of specific victims. Authentication (valid buyer token) is required, but no further preconditions exist.

Affected products

PickMall Lilishop up to 4.2.4

Timeline

2026-09-16: disclosed: Issue reported on GitHub
2026-10-06: advisory: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.