CVE-2026-108696: CoreShop through 1.5.5 Authorization Bypass via OrderController OrderConfirm and SendReship
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm receipt of others' orders and overwrite return tracking details.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an authenticated CoreShop customer. The vulnerability is exposed through the OrderController endpoints when the attacker supplies user-controlled order-related identifiers.
What actions can an attacker perform against another customer's order?
By omitting the data field in OrderConfirm, an attacker can confirm receipt of another customer's order. By providing a different reshipId to SendReship, the attacker can overwrite return tracking details for another customer's order.
Which versions are affected?
CoreShop versions through 1.5.5 are affected.