CVE-2026-115323: EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customerid/addresses routes to add, modify, or delete saved shipping addresses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EverShopto a version that resolves this vulnerability.Fixed in 2.2.1
Event History
Frequently Asked Questions
Which deployments are affected?
EverShop versions 1.2.2 through versions before 2.2.1 are affected. Version 2.2.1 is identified as the fixed release.
What does an attacker need to exploit this issue?
The attacker does not need authentication or user interaction, but must know the relevant customer and address UUIDs. They can then send POST, PATCH, or DELETE requests to the customer address API routes.
What can an attacker do through the vulnerable API?
An attacker can add, modify, or delete saved shipping addresses belonging to other customers. The affected endpoint pattern is /api/customers/:customer_id/addresses.
How can I determine whether an instance may be exposed?
An instance may be exposed if it runs an affected EverShop version and permits unauthenticated POST, PATCH, or DELETE requests to customer address API routes. Exposure also depends on an attacker obtaining customer and address UUIDs.