CVE-2026-72843: Missing Authorization in evershopcommerce evershop
Description
The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to that record, hashing a password if one is provided, without verifying that the caller owns the record. An unauthenticated request carrying a known customer uuid can therefore overwrite that customer's email address and password and read back the updated record from the 200 response, taking over the account and locking out its owner. Customer uuids are exposed through order confirmation email links and administrative URLs. Version 2.2.1 changes the route to "access": "private".
CVSS v4.0
Score 9.3critical
Affected software
evershopcommerce
evershop
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in EverShop occurs because the customer update route is declared with "access": "public" in the route configuration, causing the admin authentication middleware to bypass authorization checks. No customer-session middleware protects the route, and the only middleware parses the JSON body. The updateCustomer handler loads the customer record by UUID from the URL path and updates fields, including password hashing, without verifying ownership. Since customer UUIDs are exposed in order confirmation emails and admin URLs, an attacker can send unauthenticated requests to overwrite any customer's email and password, effectively taking over the account. This flaw is fixed in version 2.2.1 by changing the route access to "private".
Potential Impact
An unauthenticated attacker can take over any customer account by exploiting this vulnerability, leading to unauthorized access, account lockout of legitimate users, and potential data compromise. The vulnerability has a CVSS 4.0 score of 9.3 (critical), indicating high impact with network attack vector, no privileges or user interaction required, and high confidentiality, integrity, and availability impacts.
Mitigation Recommendations
Upgrade to EverShop version 2.2.1 or later, where the customer update route access is changed to "private" to enforce proper authorization. Until upgrade, restrict access to the customer update API route to trusted users only. Patch status is confirmed fixed in version 2.2.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-10T15:14:51.467Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a877ac9acd9273b4930262e
Added to database: 08/20/2026, 22:08:09 UTC
Last enriched: 10/02/2026, 15:51:20 UTC
Last updated: 10/05/2026, 06:48:18 UTC
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.