Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by… (CVE-2026-110771)

CVE-2026-110771 describes an authorization bypass vulnerability in Shopizer up to version 3.2.5. Authenticated users can exploit this flaw by supplying a crafted customerId field in POST requests to the /api/v1/auth/products/{id}/reviews endpoint. This allows them to impersonate other customers when posting product reviews and ratings, undermining the integrity of customer-generated content and product reputation.

The vulnerability allows attackers with valid authentication to submit reviews and ratings on behalf of other customers. This can lead to corrupted product ratings and misattributed reviews, potentially misleading other customers and damaging trust in the platform's review system. There is no indication of confidentiality or availability impact.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the review submission API or validating the customerId field server-side to ensure it matches the authenticated user.