Authorization Bypass in iWebShop via Update Controller

A security vulnerability (CVE-2026-86665) has been identified in the iWebShop e-commerce platform, affecting all versions up to and including 5.15. The flaw resides within the Update::index function located in controllers/update.php. This vulnerability is characterized as a missing authorization issue, which can be exploited remotely by unauthenticated actors to interact with functions intended only for administrative users. As this vulnerability affects a core administrative controller, successful exploitation could lead to unauthorized system configuration changes or administrative control over the e-commerce environment. Public exploits are currently available, and the vendor has not yet addressed the issue. Defenders should prioritize restricting network access to the application's administrative and update-related routes to mitigate the risk of remote exploitation.

Impact

Successful exploitation of this vulnerability allows unauthenticated remote attackers to bypass security controls and perform administrative actions within the iWebShop environment. This could result in unauthorized modification of store configurations, potential data exposure, or complete site takeover, depending on the capabilities exposed by the Update controller.

Recommendation

• Monitor web access logs for unauthorized POST or GET requests targeting controllers/update.php from non-administrative IP addresses.
• Implement access control lists at the web server level to restrict access to the /controllers/update.php path, ensuring only authorized administrative management networks can reach this endpoint.
• Audit existing administrative user accounts and system configuration logs for unexpected changes that may have occurred since the public release of the exploit.