CVE-2026-115323 Details

A missing authorization vulnerability has been identified in the EverShop eCommerce platform, specifically in versions 1.2.2 prior to 2.2.1. This vulnerability allows unauthenticated attackers to manage customer addresses through the API. Attackers with knowledge of specific customer and address UUIDs can exploit this issue by sending POST, PATCH, or DELETE requests to the customer address routes. The vulnerability arises from a lack of proper authorization checks, enabling unauthorized users to add, modify, or delete saved shipping addresses for other customers.

Users are advised to upgrade to EverShop version 2.2.1, where this vulnerability has been fixed. The update process involves downloading the latest version, running the included database migrations, and re-uploading any necessary assets such as the store logo.