{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/evershop/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-72843"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["EverShop (\u003c 2.2.1)"],"_cs_severities":["critical"],"_cs_tags":["web-application","privilege-escalation","account-takeover"],"_cs_type":"advisory","_cs_vendors":["EverShop"],"content_html":"\u003cp\u003eEverShop versions prior to 2.2.1 contain a critical authorization flaw in the customer update API route. The file \u003ccode\u003epackages/evershop/src/modules/customer/api/updateCustomer/route.json\u003c/code\u003e incorrectly declares the update route with \u0026quot;access\u0026quot;: \u0026quot;public\u0026quot;, which causes the administrative authentication middleware to skip validation entirely. Additionally, no session-based middleware exists to ensure the caller has authorization to modify the requested account.\u003c/p\u003e\n\u003cp\u003eThe corresponding handler in \u003ccode\u003eupdateCustomer.js\u003c/code\u003e retrieves customer records using a UUID provided in the URL path. It then performs unvalidated write operations on that record, including updating credentials and email addresses. Because the application fails to verify ownership of the record, an unauthenticated attacker who identifies a valid customer UUID - often discoverable through order confirmation emails or administrative interfaces - can overwrite account details and gain full control over any registered customer profile, effectively locking out the legitimate user.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker harvests a target customer UUID from leaked sources such as order confirmation emails or exposed administrative logs.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an unauthenticated HTTP POST request targeting the vulnerable \u003ccode\u003e/api/update-customer/:uuid\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe EverShop application receives the request, failing to trigger the administrative middleware due to the 'public' route configuration.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eupdateCustomer\u003c/code\u003e handler executes, identifying the customer record associated with the supplied UUID in the URL path.\u003c/li\u003e\n\u003cli\u003eThe application parses the malicious JSON body provided in the request, which contains updated email and password values.\u003c/li\u003e\n\u003cli\u003eThe application performs a write operation to the database, overwriting the legitimate user's credentials with attacker-provided data.\u003c/li\u003e\n\u003cli\u003eThe application returns a 200 OK response containing the modified customer record.\u003c/li\u003e\n\u003cli\u003eAttacker uses the updated credentials to log into the victim's account, completing the account takeover and denying access to the original owner.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full unauthorized access to any user account within the EverShop instance. This leads to immediate account takeover, potential data exfiltration of customer information linked to the profile, and complete lockout of the legitimate owner. Given the 9.8 CVSS score and the ease of identifying UUIDs, this vulnerability poses a severe risk to any organization operating an internet-facing EverShop store.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the EverShop installation to version 2.2.1 or later to enforce 'private' access on the updateCustomer route.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for unauthorized POST requests to \u003ccode\u003e/api/update-customer/\u003c/code\u003e that originate from unexpected IP addresses or occur without corresponding authentication headers.\u003c/li\u003e\n\u003cli\u003eAudit administrative logs for unusual UUID enumeration patterns or high volumes of profile update requests originating from single source IPs.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to webserver logs to identify potential exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-20T23:21:57Z","date_published":"2026-08-20T23:21:57Z","id":"https://feed.craftedsignal.io/briefs/2026-08-evershop-auth-bypass/","summary":"An improper authorization vulnerability in EverShop versions prior to 2.2.1 allows unauthenticated attackers to hijack customer accounts by exploiting an incorrectly configured API route.","title":"EverShop Unauthenticated Account Takeover via Improper Authorization","url":"https://feed.craftedsignal.io/briefs/2026-08-evershop-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - EverShop","version":"https://jsonfeed.org/version/1.1"}