CVE-2026-112071: Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any site visitor can exploit it, provided the site exposes a page containing the shop's order plugin. The attacker does not need to own the targeted order.
Which orders are affected?
Only orders that are still awaiting payment can be canceled through this issue. Orders that have already been paid are not affected.
What must an attacker know or control?
The attacker needs to supply an order identifier in the cancellation request. The vulnerable function does not verify that the requester owns the referenced order.