---
id: "CVE-2026-115323"
kind: "vulnerability"
aliases: ["CVE-2026-115323"]
title: "EverShop: missing authorization lets anyone change other customers' addresses"
severity: "high"
cvss: 7.3
epss: 0.00242
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "evershop", "nodejs", "package", "self-hosted"]
not_affected_if: ["version-2.2.1-or-later"]
published_at: "2026-10-22T11:17:51+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T03:27:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115323", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115323", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# EverShop: missing authorization lets anyone change other customers' addresses

EverShop versions 1.2.2 before 2.2.1 fail to check authorization on the customer address API. An unauthenticated attacker who knows a customer and address UUID can add, modify or delete that customer's saved shipping addresses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed EverShop version with `npm ls @evershop/evershop` or by reading the `version` field in `package.json`.
- Look for customer address routes under `/api/customers/:customer_id/addresses` in the deployed app.

## Fix

- Upgrade EverShop to `2.2.1` or later.
- unknown whether a workaround exists short of upgrading.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115323
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115323

## From the sources

EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_