Access Control Flaw in PrestaShop Affects Multiple Versions
CVE-2026-71519

8.6HIGH

Key Information:

Vendor

Prestashop

Status
Prestashop
Vendor
CVE Published:
13 November 2026

What is CVE-2026-71519?

A broken access control vulnerability in PrestaShop affects versions before 8.2.9 and 9.2.1. This flaw allows an authenticated user with a Webservice API key to bypass restrictions, accessing and altering customer records across different shops in a multi-shop setup. The vulnerability arises from improper checks on shop ownership, enabling attackers to read sensitive information such as password hashes and secure keys, and modify a customer's email and password through create, update, and delete API requests. This exploit poses a significant risk, potentially leading to account takeovers.

Affected Version(s)

PrestaShop 0 < 8.2.9

PrestaShop 9.0.0 < 9.2.1

References

https://github.com/PrestaShop/PrestaShop/security/advisor...
vendor-advisory
https://github.com/PrestaShop/PrestaShop/releases/tag/9.2.1
release-notespatch
https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.9
release-notespatch

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CodeAnt AI Security Research Team
boo-code
Gurvir Bajwa
.