PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id}

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111647 · Microsoft / collected KEV context

cve-program · CVE-2026-111647

• https://hackmd.io/@hieuPenguinnn/lilishop-buyer-receipt-idor
• https://github.com/lilishop/lilishop/blob/5aa1c7ef04bb9178d8ddd535c3bbbd38a6fe1ccd/buyer-api/src/main/java/cn/lili/controller/order/ReceiptBuyerController.java#L33-L37
• https://github.com/lilishop/lilishop/blob/5aa1c7ef04bb9178d8ddd535c3bbbd38a6fe1ccd/framework/src/main/java/cn/lili/modules/order/order/serviceimpl/ReceiptServiceImpl.java#L40-L43
• https://github.com/lilishop/lilishop
• https://www.vulncheck.com/advisories/pickmall-lilishop-through-5.0.0-idor-via-buyer-trade-receipt-id

No related operational record is retained in the current change model.