CVE-2026-71519 · Runtime
NO FIX YET · SEE WHAT TO DO
PrestaShop before 8.2.9 and 9.2.1 fails to check shop ownership of customer records in its webservice API. An attacker holding a valid webservice API key can read password hashes and secure keys and change customer emails and passwords across every shop in a multi-shop installation, leading to account takeover.
first public Nov 9, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Shops running PrestaShop older than 8.2.9 or 9.2.1 with the webservice API enabled and at least one API key issued, especially multi-shop installations where a key scoped to one shop can reach customer records of others. Single-shop installations without the webservice API in use are less exposed. The sources do not say whether a key with narrow permissions is enough to exploit it.
Not affected if patched-version, single-shop, webservice-api-disabled
Who cares e-commerce, multistore, prestashop, self-hosted
composer show prestashop/prestashop where applicable; versions below 8.2.9 on the 8.x line or below 9.2.1 on the 9.x line are in range.8.2.9 or later.9.2.1 or later.PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit the missing record-level shop ownership check in shopHasRight() and saveEntityFromXml() to read sensitive customer data such as password hashes and secure keys, and change a customer's email and password via create, update, and delete requests, resulting in account takeover.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.