CVE-2026-115323
highEverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other cu…
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/evershopcommerce/evershop disclosure@vulncheck.com
- https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/cus... disclosure@vulncheck.com
- https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/cus... disclosure@vulncheck.com
- https://github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941... disclosure@vulncheck.com
- https://github.com/evershopcommerce/evershop/issues/928 disclosure@vulncheck.com
- https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/evershop-1.2.2-before-2.2.1-missing-authorization-via... disclosure@vulncheck.com