Authorization Flaw in PrestaShop Webservice API Allows Unauthorized Access
CVE-2026-71531

8.6HIGH

Key Information:

Vendor

Prestashop

Status
Prestashop
Vendor
CVE Published:
13 November 2026

What is CVE-2026-71531?

PrestaShop prior to versions 8.2.9 and 9.2.1 is vulnerable to an authorization flaw in its Webservice API. This vulnerability allows an attacker with a restricted key to submit requests that manipulate the shop context, specifically by using id_shop=all or id_shop_group=N. The flaw occurs because the system fails to adequately validate the key against its associated shop, enabling unauthorized access to sensitive data across the application. Attackers can exploit this vulnerability to read, modify, or delete critical data, including customer records such as email addresses, secure keys, and password hashes.

Affected Version(s)

PrestaShop 0 < 8.2.9

PrestaShop 9.0.0 < 9.2.1

References

https://github.com/PrestaShop/PrestaShop/security/advisor...
vendor-advisory
https://github.com/PrestaShop/PrestaShop/releases/tag/9.2.1
release-notespatch
https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.9
release-notespatch

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CodeAnt AI Security Research Team
Sakil Ahamed Gayen
Gurvir Bajwa
.