Threats affecting pkg:github/PrestaShop

PrestaShop versions before 8.2.9 and 9.2.1 have an authorization bypass vulnerability in multi-shop setups. Authenticated Webservice API key holders can read and modify customer records across shops without proper ownership checks. This flaw allows attackers to access sensitive customer data including password hashes and secure keys, and to change customer emails and passwords, potentially leading to account takeover.

CVE-2026-71531 is an authorization vulnerability in PrestaShop versions before 8.2.9 and 9.2.1 affecting the Webservice API. It allows attackers with a restricted shop key to bypass shop-specific access controls by manipulating the id_shop parameter to access data from all shops. This flaw enables unauthorized reading, modification, or deletion of data across shops, including sensitive customer information such as email addresses, secure keys, and password hashes.