Threats affecting pkg:github/shopxo/shopxo

CVE-2026-12204 is an authorization bypass vulnerability in ShopXO versions 6.7.0 and 6.7.1. It affects several functions within the Scheduled Task Endpoint component, specifically in the app/api/controller/Crontab.php file. The vulnerability allows remote attackers to manipulate these functions to bypass authorization controls. The vulnerability has a medium severity rating with a CVSS score of 6.9. The vendor has not responded to the disclosure, and no official patch or remediation guidance is currently available.