CVE-2026-115323

Name of the Vulnerable Software and Affected Versions EverShop versions 1.2.2 through 2.2.0

Description A missing authorization issue exists in the customer address API, allowing unauthenticated attackers to manage addresses belonging to other customers. Attackers possessing the customer id and address UUIDs can perform unauthorized actions by sending POST, PATCH, or DELETE requests to the '/api/customers/:customer id/addresses' endpoint to add, modify, or delete saved shipping addresses.

Recommendations Update EverShop to version 2.2.1 or later. Restrict access to the '/api/customers/:customer id/addresses' endpoint to authorized users only.