CVE-2026-115323: medium-severity vulnerability in evershopcommerce evershop
EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.2%
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
evershopcommerce · evershopRelated CVEs — evershopcommerce evershop
In the same product, most dangerous first.
CVE-2026-72843CRITICALEverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account TakeoverEPSS 0.8%CVE-2026-28213CRITICALEverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API ResponseEPSS 0.5%CVE-2026-25993CRITICALEverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL KeysEPSS 0.4%
References
https://github.com/evershopcommerce/evershophttps://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/deleteCustomerAddress/route.jsonhttps://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomerAddress/updateCustomerAddress.jshttps://github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941f7https://github.com/evershopcommerce/evershop/issues/928https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1https://www.vulncheck.com/advisories/evershop-1.2.2-before-2.2.1-missing-authorization-via-customer-address-api