CVE-2026-115323

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-115323

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115323.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-115323

Published

2026-10-22T10:57:42Z

Modified

2026-10-23T02:45:48Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API

Details

EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115323.json"
}

References

Affected packages

Git / github.com/evershopcommerce/evershop

Affected ranges

Type

GIT

Repo

https://github.com/evershopcommerce/evershop

Events

Introduced

a6e3783e479ecc838ae30a3b9e1328fd5cd4e5f2

Fixed

89d09fbd200931daa892c59ee8e5866490788e4c

Fixed

af6e6fd935c4194668b11a924b847542598941f7

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.2.2"
                },
                {
                    "fixed":  "2.2.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "af6e6fd935c4194668b11a924b847542598941f7"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v2.2.1",
            "range":  [
                {
                    "fixed":  "89d09fbd200931daa892c59ee8e5866490788e4c"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115323.json"