CVE-2026-111348

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111348
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111348.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111348
Published
2026-10-15T21:43:39Z
Modified
2026-10-21T10:31:04Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints
Details

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111348.json"
}
References

Affected packages

Git / github.com/likeadmin-likeshop/likeshop

Affected ranges

Type
GIT
Repo
https://github.com/likeadmin-likeshop/likeshop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
a5874b7ac5aaf4020e6a0c2b77a4e711a7d27c30
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "3.5.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "3.5.1"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

2.*
2.5.7
3.*
3.0.3
3.0.4
3.0.5
3.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111348.json"