CVE-2026-72843

Name of the Vulnerable Software and Affected Versions EverShop versions prior to 2.2.1

Description An authorization flaw exists in the customer update route. The route is incorrectly configured as public, allowing the admin authentication middleware to bypass caller verification. Additionally, the route lacks customer-session middleware protection. The handler in updateCustomer.js processes updates based on a uuid provided in the URL path without verifying if the requester owns the record. This allows an unauthenticated attacker with a known customer uuid to overwrite a customer's email address and password via the PATCH '/api/customers/:id' endpoint, leading to full account takeover. Customer uuid values may be exposed through administrative URLs and order confirmation email links.

Recommendations Update to version 2.2.1.