Skip to content
Threat Feed
Subscribe
high advisory

EverShop: Missing authorization in customer address API (CVE-2026-115323)

EverShop versions prior to 2.2.1 contain a missing authorization vulnerability in the customer address API, allowing unauthenticated attackers to manipulate other users' shipping addresses if the customer and address UUIDs are known.

CVE search metadata

CVE search record: CVE-2026-115323. Severity: high. CVSS: 7.3. KEV: no. Product: EverShop (< 2.2.1). Brief: EverShop: Missing authorization in customer address API (CVE-2026-115323). Brief link: https://feed.craftedsignal.io/briefs/2026-10-evershop-auth-bypass/

Triage facts

Revision 1
Applicability
EverShop (< 2.2.1)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 22, 14:16 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

EverShop 1.2.2 through 2.2.0 contain a missing authorization vulnerability in the customer address API (CVE-2026-115323). This flaw allows unauthenticated attackers who possess knowledge of specific customer and address UUIDs to perform unauthorized POST, PATCH, or DELETE operations on the /api/customers/:customer_id/addresses routes. Exploitation could lead to unauthorized modification or removal of customer shipping data.

Impact

Successful exploitation allows for the unauthorized modification, addition, or deletion of shipping addresses associated with any EverShop customer account, provided the attacker has obtained the necessary UUID identifiers.

Recommendation

  • Upgrade to EverShop 2.2.1 or later immediately to resolve the missing authorization flaw.
  • Audit API logs for unauthorized POST, PATCH, or DELETE requests targeting /api/customers/ endpoints that originate from unauthenticated sessions or atypical IP addresses.
  • Monitor for high volumes of API requests targeting address UUIDs to identify potential enumeration or bulk modification attempts.

Immediate actions

Patch EverShop to version 2.2.1

IT Operations 48h

Mitigations

Upgrade EverShop to version 2.2.1

immediate IT Operations

CVE-2026-115323

Detection coverage 1

Detect CVE-2026-115323 Exploitation - Unauthorized Address API Modification

high

Detects potential exploitation of CVE-2026-115323 by identifying POST, PATCH, or DELETE requests to the customer address API path

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →