{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aevershopevershop/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:evershop:evershop:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-115323"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["EverShop (\u003c 2.2.1)"],"_cs_severities":["high"],"_cs_tags":["web-application","authentication-bypass","api-security"],"_cs_type":"advisory","_cs_vendors":["EverShop"],"content_html":"\u003cp\u003eEverShop 1.2.2 through 2.2.0 contain a missing authorization vulnerability in the customer address API (CVE-2026-115323). This flaw allows unauthenticated attackers who possess knowledge of specific customer and address UUIDs to perform unauthorized POST, PATCH, or DELETE operations on the \u003ccode\u003e/api/customers/:customer_id/addresses\u003c/code\u003e routes. Exploitation could lead to unauthorized modification or removal of customer shipping data.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized modification, addition, or deletion of shipping addresses associated with any EverShop customer account, provided the attacker has obtained the necessary UUID identifiers.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to EverShop 2.2.1 or later immediately to resolve the missing authorization flaw.\u003c/li\u003e\n\u003cli\u003eAudit API logs for unauthorized \u003ccode\u003ePOST\u003c/code\u003e, \u003ccode\u003ePATCH\u003c/code\u003e, or \u003ccode\u003eDELETE\u003c/code\u003e requests targeting \u003ccode\u003e/api/customers/\u003c/code\u003e endpoints that originate from unauthenticated sessions or atypical IP addresses.\u003c/li\u003e\n\u003cli\u003eMonitor for high volumes of API requests targeting address UUIDs to identify potential enumeration or bulk modification attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T14:16:41Z","date_published":"2026-10-22T14:16:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-evershop-auth-bypass/","summary":"EverShop versions prior to 2.2.1 contain a missing authorization vulnerability in the customer address API, allowing unauthenticated attackers to manipulate other users' shipping addresses if the customer and address UUIDs are known.","title":"EverShop: Missing authorization in customer address API (CVE-2026-115323)","url":"https://feed.craftedsignal.io/briefs/2026-10-evershop-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:evershop:evershop:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}