Is CVE-2026-110122 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110122?

CVE-2026-110122 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-110122

Description

PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges.