CVE-2026-72843

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-72843
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72843.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72843
Published
2026-08-20T21:57:34Z
Modified
2026-08-23T03:42:28Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover
Details

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to that record, hashing a password if one is provided, without verifying that the caller owns the record. An unauthenticated request carrying a known customer uuid can therefore overwrite that customer's email address and password and read back the updated record from the 200 response, taking over the account and locking out its owner. Customer uuids are exposed through order confirmation email links and administrative URLs. Version 2.2.1 changes the route to "access": "private".

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72843.json"
}
References

Affected packages

Git / github.com/evershopcommerce/evershop

Affected ranges

Type
GIT
Repo
https://github.com/evershopcommerce/evershop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
89d09fbd200931daa892c59ee8e5866490788e4c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.2.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0.0-rc.9
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72843.json"