CVE-2026-115323
CVE-2026-115323 · EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
CVSS 6.9 · Moyenne · EPSS 0,2% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
evershop
- Versions du logiciel
- ≥ 1.2.2, < 2.2.1: Concernée (semver)
- 2.2.1: Non concernée (semver)
Mettez à jour vers 2.2.1
Sources originales
- https://github.com/evershopcommerce/evershop/issues/928
- https://github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941f7
- https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1
- https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomerAddress/updateCustomerAddress.js
- https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/deleteCustomerAddress/route.json
- https://github.com/evershopcommerce/evershop
- https://www.vulncheck.com/advisories/evershop-1.2.2-before-2.2.1-missing-authorization-via-customer-address-api
- https://nvd.nist.gov/vuln/detail/CVE-2026-115323