CVE-2026-110771
CVE-2026-110771 · Shopizer through 3.2.5 Authorization Bypass via Product Review customerId
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.
CVSS 5.3 · Mittel · EPSS 0,2%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
shopizer
- Softwareversionen
- ≥ 0, ≤ 3.2.5: Betroffen (semver)
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/shopizer-ecommerce/shopizer/issues/1112
- https://hackmd.io/@hieuPenguinnn/shopizer-rest-product-review-idor
- https://github.com/shopizer-ecommerce/shopizer/blob/9a1602a664ab882b5420ff4339db45af44a48423/sm-shop/src/main/java/com/salesmanager/shop/populator/catalog/PersistableProductReviewPopulator.java#L66
- https://github.com/shopizer-ecommerce/shopizer
- https://www.vulncheck.com/advisories/shopizer-through-3.2.5-authorization-bypass-via-product-review-customerid
- https://nvd.nist.gov/vuln/detail/CVE-2026-110771