CVE-2026-71519: PrestaShop Webservice API Broken Access Control via Customer Endpoint

Published Nov 13, 2026

Updated

PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit the missing record-level shop ownership check in shopHasRight() and saveEntityFromXml() to read sensitive customer data such as password hashes and secure keys, and change a customer's email and password via create, update, and delete requests, resulting in account takeover.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.2.9
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.1

Event History

Nov 13, 2026

CVE Published

via MITRE·10:33 PM

Data Sourced

via MITRE·10:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Multi-shop PrestaShop installations running a version before 8.2.9 or 9.2.1 are exposed if an attacker has an authenticated Webservice API key. The issue allows that key holder to access customer records across shop boundaries.

What can an attacker do with a Webservice API key?

An attacker can read sensitive customer information, including password hashes and secure keys, from other shops. They can also use create, update, and delete requests to change customer email addresses and passwords, enabling account takeover.

Is user interaction required for exploitation?

No. The supplied vector indicates network-reachable exploitation with low complexity and no user interaction, but the attacker must already hold a Webservice API key.

How can this be remediated?

Upgrade PrestaShop to 8.2.9 or 9.2.1. These are the versions identified as fixing the issue.

CVE-2026-71519: PrestaShop Webservice API Broken Access Control via Customer Endpoint

Remediation

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What can an attacker do with a Webservice API key?

Is user interaction required for exploitation?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What can an attacker do with a Webservice API key?

Is user interaction required for exploitation?

How can this be remediated?