CVE-2026-110771: Shopizer through 3.2.5 Authorization Bypass via Product Review customerId
Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Shopizer customer can exploit it. The attacker does not need interaction from the victim, but must be able to submit a crafted product-review request.
Which endpoint is involved?
The affected endpoint is POST /api/v1/auth/products/{id}/reviews. A crafted request can include a customerId field for another customer.
What is the impact of successful exploitation?
An attacker can publish reviews and ratings attributed to other store customers. This can corrupt review authorship and product ratings, while the provided data indicates no confidentiality or availability impact.
Are default deployments affected?
The provided information identifies Shopizer through version 3.2.5 as affected, but does not state whether a specific default configuration is required. Exploitation requires authenticated customer access and the ability to submit product reviews.