CVE-2026-115323: falha de média gravidade em evershopcommerce evershop
EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.2%
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
evershopcommerce · evershopCVEs relacionadas — evershopcommerce evershop
No mesmo produto, das mais perigosas para as menos.
CVE-2026-72843CRITICALEverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account TakeoverEPSS 0.8%CVE-2026-28213CRITICALEverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API ResponseEPSS 0.5%CVE-2026-25993CRITICALEverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL KeysEPSS 0.4%
Referências
https://github.com/evershopcommerce/evershophttps://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/deleteCustomerAddress/route.jsonhttps://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomerAddress/updateCustomerAddress.jshttps://github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941f7https://github.com/evershopcommerce/evershop/issues/928https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1https://www.vulncheck.com/advisories/evershop-1.2.2-before-2.2.1-missing-authorization-via-customer-address-api