The vulnerability in EverShop exists because the customer update route is declared with "access": "public" in the route configuration, causing the admin authentication middleware to skip verification. No customer-session middleware protects the route, and the only middleware parses JSON bodies. The update handler loads the customer record by UUID from the URL and writes supplied fields, including password changes, without verifying the requester's ownership of the account. Since customer UUIDs are exposed in order confirmation emails and admin URLs, an attacker can perform unauthenticated requests to overwrite customer credentials and take over accounts. This issue affects versions prior to 2.2.1, which fixes the problem by setting the route access to private.

An attacker can take over any customer account by knowing the customer's UUID, allowing unauthorized changes to email and password fields. This leads to account compromise and denial of access for the legitimate owner. The vulnerability has a CVSS 4.0 score of 9.3 (critical), reflecting its ease of exploitation (network, no privileges or user interaction required) and high impact on confidentiality, integrity, and availability of customer accounts.

Version 2.2.1 of EverShop changes the customer update route access from public to private, enforcing proper authorization. Users should upgrade to version 2.2.1 or later to remediate this vulnerability. No other official remediation or temporary fixes are documented. Until upgrading, restrict access to the affected API endpoint to trusted users only.