CVE-2026-110608: Authorization Bypass Through User-Controlled Key in BizSpring BizSpring Shop

BizSpring Shop contains an insecure direct object reference vulnerability in the OrderController's cancel and receive handlers. Authenticated members can supply arbitrary orderId values to perform actions on orders belonging to other users. This allows attackers to cancel pending orders to free allocated stock or confirm receipt of shipped orders prematurely, thereby interfering with normal order processing and settlement.

An attacker with authenticated access can manipulate other users' orders by cancelling them or confirming receipt without authorization. This can lead to stock misallocation and premature order settlement, potentially causing operational disruption and financial inconsistencies. The vulnerability requires low attack complexity and no user interaction but does require authentication with limited privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access controls on order operations and monitor for unauthorized order manipulations. Avoid exposing order identifiers in a way that allows unauthorized users to act on them.