CVE-2026-7630: Improper Authentication in innocommerce InnoShop
A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/install/src/InstallServiceProvider.php of the component Installation Endpoint. The manipulation leads to improper authentication. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 45758e4ec22451ab944ae2ae826b1e70f6450dc9. It is recommended to apply a patch to fix this issue.
AI Analysis
Technical Summary
The vulnerability exists in the InstallServiceProvider::boot function of the installation endpoint in innocommerce InnoShop versions up to 0.7.8. It leads to improper authentication, enabling remote attackers to potentially bypass authentication controls. The issue has a CVSS 4.0 score of 6.9, indicating a medium severity with network attack vector, no privileges required, and no user interaction needed. A patch is available as identified by the commit hash 45758e4ec22451ab944ae2ae826b1e70f6450dc9. Since InnoShop is a cloud service, the vendor typically manages patch deployment.
Potential Impact
The vulnerability allows remote attackers to bypass authentication mechanisms in the installation endpoint, potentially leading to unauthorized access or actions within the affected InnoShop instances. The CVSS score of 6.9 reflects a medium severity impact with low complexity and no required privileges or user interaction. No known active exploitation has been reported yet.
Mitigation Recommendations
A patch is available for this vulnerability, identified by commit 45758e4ec22451ab944ae2ae826b1e70f6450dc9. Since InnoShop is a cloud-hosted service, the vendor generally manages remediation and patch deployment server-side. Users should verify with the vendor's advisory or support channels to confirm that the patch has been applied to their environment. Patch status is confirmed available; applying the official fix is recommended.
CVE-2026-7630: Improper Authentication in innocommerce InnoShop
Description
A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/install/src/InstallServiceProvider.php of the component Installation Endpoint. The manipulation leads to improper authentication. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 45758e4ec22451ab944ae2ae826b1e70f6450dc9. It is recommended to apply a patch to fix this issue.
CVSS v4.0
Score 6.9medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the InstallServiceProvider::boot function of the installation endpoint in innocommerce InnoShop versions up to 0.7.8. It leads to improper authentication, enabling remote attackers to potentially bypass authentication controls. The issue has a CVSS 4.0 score of 6.9, indicating a medium severity with network attack vector, no privileges required, and no user interaction needed. A patch is available as identified by the commit hash 45758e4ec22451ab944ae2ae826b1e70f6450dc9. Since InnoShop is a cloud service, the vendor typically manages patch deployment.
Potential Impact
The vulnerability allows remote attackers to bypass authentication mechanisms in the installation endpoint, potentially leading to unauthorized access or actions within the affected InnoShop instances. The CVSS score of 6.9 reflects a medium severity impact with low complexity and no required privileges or user interaction. No known active exploitation has been reported yet.
Mitigation Recommendations
A patch is available for this vulnerability, identified by commit 45758e4ec22451ab944ae2ae826b1e70f6450dc9. Since InnoShop is a cloud-hosted service, the vendor generally manages remediation and patch deployment server-side. Users should verify with the vendor's advisory or support channels to confirm that the patch has been applied to their environment. Patch status is confirmed available; applying the official fix is recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-01T14:28:41.503Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 69f5fdd6cbff5d8610e1a559
Added to database: 5/2/2026, 1:36:22 PM
Last enriched: 5/10/2026, 2:15:22 AM
Last updated: 6/17/2026, 1:04:53 AM
Views: 89
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.