CVE-2026-110771

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110771
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110771.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110771
Published
2026-10-14T18:47:57Z
Modified
2026-10-15T10:47:27Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Shopizer through 3.2.5 Authorization Bypass via Product Review customerId
Details

Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110771.json"
}
References

Affected packages

Git / github.com/shopizer-ecommerce/shopizer

Affected ranges

Type
GIT
Repo
https://github.com/shopizer-ecommerce/shopizer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
9a1602a664ab882b5420ff4339db45af44a48423
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "3.2.5"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

2.*
2.13.0
2.14.1
2.15.0
2.16.0
2.17.0
3.*
3.0.0
3.0.1
3.1.0
3.2.0
3.2.2
v2.*
v2.13.0
v2.14.0
v2.14.1
v3.*
v3.0.1
v3.2.2
v3.2.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110771.json"