CVE-2026-108696: Authorization Bypass Through User-Controlled Key in CoreUnion CoreShop

CVE-2026-108696 is an authorization bypass vulnerability in CoreShop through version 1.5.5. The flaw exists in the OrderController where authenticated users can supply user-controlled IDs to perform actions on orders belonging to other customers. Specifically, attackers can omit the data field in OrderConfirm or provide a different reshipId in SendReship to confirm receipt of others' orders and overwrite return tracking information.

An attacker with authenticated access can perform unauthorized actions on other customers' orders, including confirming receipt and modifying return tracking details. This could lead to order manipulation and potential disruption of order fulfillment or return processes. The CVSS 4.0 score is 5.3 (medium severity), indicating a moderate impact without requiring user interaction or high privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access controls and monitor for suspicious order modifications by authenticated users. Avoid using versions up to 1.5.5 in production environments if possible.