Cpe:2.3:a:evershop:evershop:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aevershopevershop/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 14:16:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEverShop: Missing authorization in customer address API (CVE-2026-115323)https://feed.craftedsignal.io/briefs/2026-10-evershop-auth-bypass/Thu, 22 Oct 2026 14:16:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-evershop-auth-bypass/EverShop versions prior to 2.2.1 contain a missing authorization vulnerability in the customer address API, allowing unauthenticated attackers to manipulate other users' shipping addresses if the customer and address UUIDs are known.EverShop 1.2.2 through 2.2.0 contain a missing authorization vulnerability in the customer address API (CVE-2026-115323). This flaw allows unauthenticated attackers who possess knowledge of specific customer and address UUIDs to perform unauthorized POST, PATCH, or DELETE operations on the /api/customers/:customer_id/addresses routes. Exploitation could lead to unauthorized modification or removal of customer shipping data.

Impact

Successful exploitation allows for the unauthorized modification, addition, or deletion of shipping addresses associated with any EverShop customer account, provided the attacker has obtained the necessary UUID identifiers.

Recommendation

  • Upgrade to EverShop 2.2.1 or later immediately to resolve the missing authorization flaw.
  • Audit API logs for unauthorized POST, PATCH, or DELETE requests targeting /api/customers/ endpoints that originate from unauthenticated sessions or atypical IP addresses.
  • Monitor for high volumes of API requests targeting address UUIDs to identify potential enumeration or bulk modification attempts.
]]>highadvisoryweb-applicationauthentication-bypassapi-security