Is CVE-2026-111647 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111647 being exploited in the wild.

How severe is CVE-2026-111647?

Medium severity, with a CVSS score of 4.3, published 16 October 2026.

Which products and versions are affected?

PickMall Lilishop through 5.0.0.

Is there a fix for CVE-2026-111647?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111647 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111647?

Check whether you run PickMall Lilishop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111647: PickMall lilishop insecure direct object reference in receipt endpoint

CVE-2026-111647 · Severity: medium · CVSS 4.3 · Published 2026-10-16

PickMall lilishop is an open-source B2B2C e-commerce platform. An authenticated buyer can read other buyers' invoice records by manipulating the receipt ID in API requests, exposing sensitive data including taxpayer identification numbers, order numbers, and personal names. This allows competitors or malicious users with a basic account to spy on other customers' financial transactions.

Technologies: PickMall Lilishop. Vendors: PickMall.

Quick answers

Is CVE-2026-111647 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111647 being exploited in the wild.
How severe is CVE-2026-111647?: Medium severity, with a CVSS score of 4.3, published 16 October 2026.
Which products and versions are affected?: PickMall Lilishop through 5.0.0.
Is there a fix for CVE-2026-111647?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111647 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111647?: Check whether you run PickMall Lilishop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insecure direct object reference (IDOR) in the ReceiptBuyerController.getDetail() endpoint at GET /buyer/trade/receipt/{id}. The ReceiptServiceImpl.getDetail() method fails to verify that the authenticated user owns the requested receipt before returning it. An authenticated attacker can supply arbitrary receipt IDs to enumerate and read other buyers' invoice data including titles, tax IDs, order numbers, member IDs, and names. The vulnerability requires prior authentication as a buyer but no other preconditions.

Affected products

PickMall lilishop through 5.0.0

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.