{"id":"CVE-2026-112035","kind":"vulnerability","aliases":["CVE-2026-112035"],"related":[],"title":"iWebShop 5: weak password recovery lets remote users reach other accounts","description":"A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send_message_mobile of the file controllers/simple.php. Such manipulation of the argument user_id leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"iWebShop 5 up to 5.16 has a flaw in the send_message_mobile function of controllers/simple.php, where the user_id argument is manipulated to abuse password recovery. A remote attacker can exploit it, and the exploit has been published.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","iwebshop","other","php","self-hosted"],"not_affected_if":["versions-above-5.16"],"how_to_check":"- Confirm the installed version is `5.16` or older.\n- Look at `controllers/simple.php` for the `send_message_mobile` function and check whether the `user_id` argument is used unchecked.","fix":null,"status":"open","published_at":"2026-10-19T01:16:37+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:57:30+00:00","updated_at":"2026-10-25T03:57:30+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:57:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown: the sources report no patched version, and the project has not responded to the issue report. Restrict or disable the mobile password recovery path until a fix is published.","reach":"internet","title":"iWebShop 5: weak password recovery lets remote users reach other accounts","impact":"medium","summary":"iWebShop 5 up to 5.16 has a flaw in the send_message_mobile function of controllers/simple.php, where the user_id argument is manipulated to abuse password recovery. A remote attacker can exploit it, and the exploit has been published.","category":"other","nicknames":[],"who_cares":["iwebshop","php","self-hosted","e-commerce"],"confidence":0.6,"needs_auth":"unknown","worst_case":"remote attacker recovers or resets other users' account passwords","analyst_note":"Check the public issue report and whether aircheng-org has published a fixed release; NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112035 does not give a fixed version.","how_to_check":"- Confirm the installed version is `5.16` or older.\n- Look at `controllers/simple.php` for the `send_message_mobile` function and check whether the `user_id` argument is used unchecked.","needs_analyst":true,"not_affected_if":["versions-above-5.16"],"who_is_affected":"Sites running iWebShop 5 up to 5.16 that expose the mobile password recovery endpoint to the internet are exposed. Installations on newer versions, or with that endpoint blocked, are not described as affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000993,"input_tokens":3344,"output_tokens":1317,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112035':14A,17A '-2026':13A,16A '-5':77C '5':2A,28B '5.16':31B,80C 'abus':51B 'account':11A 'affect':82C 'aircheng':74C 'aircheng-org':73C 'argument':47B,96C 'attack':56B,105C 'commerc':20B 'controllers/simple.php':42B,91C 'cve':12A,15A 'detect':71C 'disclos':114C 'e':19B 'e-commerc':18B 'earli':127C 'exploit':58B,62B,111C 'file':90C 'flaw':34B 'function':40B,84C 'host':26B 'id':46B,98C 'inform':123C 'issu':130C 'iwebshop':1A,21B,27B,76C 'launch':108C 'lead':99C 'let':6A 'manipul':49B,93C 'may':117C 'messag':38B,86C 'mobil':39B,87C 'org':75C 'password':4A,52B,102C 'php':23B 'problem':126C 'project':121C 'public':115C 'publish':65B 'reach':9A 'recoveri':5A,53B,103C 'remot':7A,55B,109C 'report':131C 'respond':135C 'secur':67C 'self':25B 'self-host':24B 'send':37B,85C 'use':119C 'user':8A,45B,97C 'vulner':68C 'weak':3A,101C 'yet':136C","nicknames":[],"mitigations":[],"who_affected":"Sites running iWebShop 5 up to 5.16 that expose the mobile password recovery endpoint to the internet are exposed. Installations on newer versions, or with that endpoint blocked, are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T01:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112035","severity":null,"published_at":"2026-10-19T01:16:37+00:00","modified_at":"2026-10-19T17:17:08+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}