Live › vulnerability › CVE-2026-115323
Go to dashboardEverShop versions 1.2.2 before 2.2.1 fail to check authorization on the customer address API. An unauthenticated attacker who knows a customer and address UUID can add, modify or delete that customer's saved shipping addresses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any self-hosted EverShop store running a version from 1.2.2 up to but not including 2.2.1 is exposed, since the flaw sits in the public customer address API. Stores on 2.2.1 or later are not affected. The sources do not say whether managed hosting changes exposure.
No product ranges from the sources yet.
npm ls @evershop/evershop or by reading the version field in package.json./api/customers/:customer_id/addresses in the deployed app.2.2.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
This page as .md · .json · in your agent: get_signal("CVE-2026-115323")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.