{"id":"CVE-2026-115323","kind":"vulnerability","aliases":["CVE-2026-115323"],"related":[],"title":"EverShop: missing authorization lets anyone change other customers' addresses","description":"EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.","summary":"EverShop versions 1.2.2 before 2.2.1 fail to check authorization on the customer address API. An unauthenticated attacker who knows a customer and address UUID can add, modify or delete that customer's saved shipping addresses.","severity":"high","cvss":7.3,"epss":0.00242,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","evershop","nodejs","package","self-hosted"],"not_affected_if":["version-2.2.1-or-later"],"how_to_check":"- Check the installed EverShop version with `npm ls @evershop/evershop` or by reading the `version` field in `package.json`.\n- Look for customer address routes under `/api/customers/:customer_id/addresses` in the deployed app.","fix":"- Upgrade EverShop to `2.2.1` or later.\n- unknown whether a workaround exists short of upgrading.","status":"open","published_at":"2026-10-22T11:17:51+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:27:20+00:00","updated_at":"2026-10-25T03:27:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:27:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade EverShop to `2.2.1` or later.\n- unknown whether a workaround exists short of upgrading.","reach":"internet","title":"EverShop: missing authorization lets anyone change other customers' addresses","impact":"medium","summary":"EverShop versions 1.2.2 before 2.2.1 fail to check authorization on the customer address API. An unauthenticated attacker who knows a customer and address UUID can add, modify or delete that customer's saved shipping addresses.","category":"package","nicknames":[],"who_cares":["evershop","nodejs","ecommerce","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker alters or deletes customers' saved shipping addresses without logging in","analyst_note":"Confirm the exact fixed version and any vendor advisory or patch notes at the NVD entry, and whether a workaround exists.","how_to_check":"- Check the installed EverShop version with `npm ls @evershop/evershop` or by reading the `version` field in `package.json`.\n- Look for customer address routes under `/api/customers/:customer_id/addresses` in the deployed app.","needs_analyst":true,"not_affected_if":["version-2.2.1-or-later"],"who_is_affected":"Any self-hosted EverShop store running a version from 1.2.2 up to but not including 2.2.1 is exposed, since the flaw sits in the public customer address API. Stores on 2.2.1 or later are not affected. The sources do not say whether managed hosting changes exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000623,"input_tokens":3390,"output_tokens":567,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115323':12A,15A '-2026':11A,14A '/api/customers':96C '1.2.2':25B,59C '2.2.1':27B,61C 'add':48B,101C 'address':9A,35B,45B,57B,70C,80C,86C,107C 'allow':73C 'anyon':5A 'api':36B,71C 'attack':39B,75C,81C 'author':3A,31B,65C 'chang':6A 'check':30B 'contain':62C 'custom':8A,34B,43B,53B,69C,79C,84C,97C 'cve':10A,13A 'delet':51B,93C,104C 'ecommerc':16B 'evershop':1A,17B,23B,58C 'fail':28B 'host':22B 'id/addresses':98C 'know':41B,83C 'let':4A 'manag':77C 'miss':2A,64C 'modifi':49B,102C 'nodej':18B 'packag':19B 'patch':91C 'post':90C 'request':94C 'rout':99C 'save':55B,105C 'self':21B 'self-host':20B 'send':89C 'ship':56B,106C 'unauthent':38B,74C 'uuid':46B,87C 'version':24B 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted EverShop store running a version from 1.2.2 up to but not including 2.2.1 is exposed, since the flaw sits in the public customer address API. Stores on 2.2.1 or later are not affected. The sources do not say whether managed hosting changes exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115323","severity":null,"published_at":"2026-10-22T11:17:51+00:00","modified_at":"2026-10-22T11:17:51+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115323","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115323","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}