CVE-2026-110771
CVE-2026-110771 · Shopizer through 3.2.5 Authorization Bypass via Product Review customerId
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.
CVSS 5.3 · Media · EPSS 0,2%
- Publicación
- Actualización
Productos y versiones afectados
shopizer
- Versiones
- ≥ 0, ≤ 3.2.5: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/shopizer-ecommerce/shopizer/issues/1112
- https://hackmd.io/@hieuPenguinnn/shopizer-rest-product-review-idor
- https://github.com/shopizer-ecommerce/shopizer/blob/9a1602a664ab882b5420ff4339db45af44a48423/sm-shop/src/main/java/com/salesmanager/shop/populator/catalog/PersistableProductReviewPopulator.java#L66
- https://github.com/shopizer-ecommerce/shopizer
- https://www.vulncheck.com/advisories/shopizer-through-3.2.5-authorization-bypass-via-product-review-customerid
- https://nvd.nist.gov/vuln/detail/CVE-2026-110771