Missing Authorization Flaw in EverShop by EverShop Commerce
CVE-2026-115323
6.9MEDIUM
What is CVE-2026-115323?
A missing authorization vulnerability in the customer address API of EverShop allows unauthorized attackers to manipulate customer address data. Unauthenticated users can exploit this flaw by knowing specific customer and address UUIDs, enabling them to send POST, PATCH, or DELETE requests to the /api/customers/:customer_id/addresses endpoint. This results in a serious security risk, as attackers can add, modify, or delete saved shipping addresses of any customer. It is crucial for users of EverShop version 1.2.2 and prior to update to version 2.2.1 or later to mitigate this vulnerability.
Affected Version(s)
evershop 1.2.2 < 2.2.1
evershop 2.2.1
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Proscan-one (ProScan AppSec)
leediay153 from Viettel Post