CVE-2026-115323: fallo de gravedad media en evershopcommerce evershop
EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.2%
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
evershopcommerce · evershopCVEs relacionadas — evershopcommerce evershop
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-72843CRITICALEverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account TakeoverEPSS 0.8%CVE-2026-28213CRITICALEverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API ResponseEPSS 0.5%CVE-2026-25993CRITICALEverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL KeysEPSS 0.4%
Referencias
https://github.com/evershopcommerce/evershophttps://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/deleteCustomerAddress/route.jsonhttps://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomerAddress/updateCustomerAddress.jshttps://github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941f7https://github.com/evershopcommerce/evershop/issues/928https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1https://www.vulncheck.com/advisories/evershop-1.2.2-before-2.2.1-missing-authorization-via-customer-address-api