CVE-2026-113468: Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
Affected Software
Event History
Frequently Asked Questions
Which orders can be altered through this issue?
Only orders that are still awaiting payment can have their stored PayPal payment notification overwritten. Orders already marked as paid are not affected.
What does an attacker need to exploit it?
The attacker only needs to be able to visit a page containing the shop's order plugin. The endpoint does not verify that submitted notification data originated from PayPal.
Are all installations of the shop extension exposed?
Exposure requires a page that contains the shop's order plugin. The provided information does not establish whether installations without such a page are affected.