Unauthorized Order Cancellation Vulnerability in TYPO3
CVE-2026-112071

6.9MEDIUM

Key Information:

Vendor

Typo3

Status
Extension "typo3 Shop By Coding.ms"
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112071?

An unauthorized order cancellation vulnerability exists in the TYPO3 Order Management Plugin, where the cancellation function improperly verifies the ownership of an order identifier received in requests. This flaw allows any unauthenticated site visitor to cancel orders that are pending payment, potentially disrupting business operations. It is important to note that already paid orders remain secure and unaffected. Proper input validation and ownership checks are critical to preventing such exploits.

Affected Version(s)

Extension "TYPO3 Shop by coding.ms" 6.0.0 < 6.3.0

Extension "TYPO3 Shop by coding.ms" 5.0.0 < 5.21.1

Extension "TYPO3 Shop by coding.ms" 0 < 4.9.4

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-036
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Le Thanh Nam
Thomas Deuling
.