CVE-2026-115323
CVE-2026-115323 · EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
CVSS 6.9 · Mittel · EPSS 0,2% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
evershop
- Softwareversionen
- ≥ 1.2.2, < 2.2.1: Betroffen (semver)
- 2.2.1: Nicht betroffen (semver)
Auf 2.2.1 aktualisieren
Originalquellen
- https://github.com/evershopcommerce/evershop/issues/928
- https://github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941f7
- https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1
- https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomerAddress/updateCustomerAddress.js
- https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/deleteCustomerAddress/route.json
- https://github.com/evershopcommerce/evershop
- https://www.vulncheck.com/advisories/evershop-1.2.2-before-2.2.1-missing-authorization-via-customer-address-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-115323