Jakub Piasecki

A missing authorization issue allows forceful browsing and access bypass. The flaw stems from insufficient protection of routes and entity fields, enabling unauthenticated attackers to perform privileged actions, manipulate orders, and access customer payment data or personally identifiable information (PII). This issue affects the shopping cart, checkout, and API functionality. It is estimated that over 42,000 deployments are affected. There are confirmed reports of active exploitation in the wild, including instances of fraudulent orders on live websites.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify access to the relationship between promotions and coupons. Consequently, a user authorized only to manage their own promotions can modify or delete coupons associated with other promotions. This issue is mitigated if the site does not enable writes through JSON:API or REST, as these are disabled by default.

An incorrect authorization issue allows forceful browsing when a store is saved. The system fails to properly verify access permissions, enabling a user with the ability to create stores or edit their own store to mark it as the site's default store. This allows the user to receive orders they are not authorized to access. This issue primarily impacts sites that grant these permissions to untrusted users, such as marketplace platforms where vendors manage their own stores.

Cross-Site Request Forgery (CSRF) occurs when a user is tricked into performing an action they did not intend to do. In this case, routes for the inbox do not verify CSRF tokens. An attacker can deceive a user with the "access commerce administration pages" permission into visiting a malicious page that dismisses notifications. Because the inbox is shared, this action hides messages, including security update notices, from all administrators.

An incorrect authorization issue allows forceful browsing within the module used for organizing tangible products into shipments for fulfillment. The module fails to sufficiently protect shipment references and shipment entity fields, leading to an access bypass. This can result in the unauthorized modification of shipment states or the deletion of shipments. Exploitation requires the attacker to possess a cart with API-based access to manipulate shipments.

An incorrect authorization issue exists in the module used for organizing tangible products into shipments for fulfillment. The system fails to sufficiently verify access permissions on the form used to resend receipts. Under specific configurations, this allows unauthorized users to perform forceful browsing to access receipts and sensitive customer information for orders they are not permitted to view.