High severity7.3NVD Advisory· Published Oct 22, 2026· Updated Oct 22, 2026
CVE-2026-115323
CVE-2026-115323
Description
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.2.1
Patches
Vulnerability mechanics
References
6- github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/deleteCustomerAddress/route.jsonnvd
- github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomerAddress/updateCustomerAddress.jsnvd
- github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941f7nvd
- github.com/evershopcommerce/evershop/issues/928nvd
- github.com/evershopcommerce/evershop/releases/tag/v2.2.1nvd
- www.vulncheck.com/advisories/evershop-1.2.2-before-2.2.1-missing-authorization-via-customer-address-apinvd
News mentions
0No linked articles in our index yet.