{"id":"CVE-2026-71519","kind":"vulnerability","aliases":["CVE-2026-71519"],"related":[],"title":"PrestaShop: a webservice API key reads and changes customers across shops","description":"PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit the missing record-level shop ownership check in shopHasRight() and saveEntityFromXml() to read sensitive customer data such as password hashes and secure keys, and change a customer's email and password via create, update, and delete requests, resulting in account takeover.","summary":"PrestaShop before 8.2.9 and 9.2.1 fails to check shop ownership of customer records in its webservice API. An attacker holding a valid webservice API key can read password hashes and secure keys and change customer emails and passwords across every shop in a multi-shop installation, leading to account takeover.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","multistore","prestashop","runtime","self-hosted"],"not_affected_if":["patched-version","single-shop","webservice-api-disabled"],"how_to_check":"- Check the installed PrestaShop version in the back office or `composer show prestashop/prestashop` where applicable; versions below `8.2.9` on the 8.x line or below `9.2.1` on the 9.x line are in range.\n- Check whether the Webservice API is enabled under Advanced Parameters > Webservice and list which API keys exist and what resources they can access.\n- Check whether the installation runs multiple shops (Multistore enabled).","fix":"- PrestaShop 8.x: upgrade to `8.2.9` or later.\n- PrestaShop 9.x: upgrade to `9.2.1` or later.","status":"open","published_at":"2026-11-13T23:17:19+00:00","first_seen_at":"2026-11-13T23:35:11+00:00","triaged_at":"2026-11-13T23:37:00+00:00","updated_at":"2026-11-13T23:37:00+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-13T23:37:00Z","model":"claude-haiku-5-5","output":{"fix":"- PrestaShop 8.x: upgrade to `8.2.9` or later.\n- PrestaShop 9.x: upgrade to `9.2.1` or later.","reach":"internet","title":"PrestaShop: a webservice API key reads and changes customers across shops","impact":"high","summary":"PrestaShop before 8.2.9 and 9.2.1 fails to check shop ownership of customer records in its webservice API. An attacker holding a valid webservice API key can read password hashes and secure keys and change customer emails and passwords across every shop in a multi-shop installation, leading to account takeover.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["prestashop","e-commerce","self-hosted","multistore"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads password hashes and takes over customer accounts","analyst_note":"","how_to_check":"- Check the installed PrestaShop version in the back office or `composer show prestashop/prestashop` where applicable; versions below `8.2.9` on the 8.x line or below `9.2.1` on the 9.x line are in range.\n- Check whether the Webservice API is enabled under Advanced Parameters > Webservice and list which API keys exist and what resources they can access.\n- Check whether the installation runs multiple shops (Multistore enabled).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["webservice-api-disabled","single-shop","patched-version"],"who_is_affected":"Shops running PrestaShop older than 8.2.9 or 9.2.1 with the webservice API enabled and at least one API key issued, especially multi-shop installations where a key scoped to one shop can reach customer records of others. Single-shop installations without the webservice API in use are less exposed. The sources do not say whether a key with narrow permissions is enough to exploit it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000812,"input_tokens":4689,"output_tokens":686,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-71519':14A,17A '8.2.9':29B,80C '9.2.1':31B,82C 'access':86C 'account':76B,156C 'across':10A,65B 'allow':90C 'api':4A,43B,50B,94C 'attack':45B,113C 'authent':92C 'belong':103C 'broken':85C 'chang':8A,60B,141C 'check':34B,123C 'commerc':20B 'contain':83C 'control':87C 'creat':149C 'custom':9A,38B,61B,101C,131C,143C 'cve':12A,15A 'data':132C 'delet':152C 'e':19B 'e-commerc':18B 'email':62B,145C 'everi':66B 'exploit':115C 'fail':32B 'hash':55B,136C 'hold':46B 'holder':96C 'host':26B 'instal':73B,112C 'key':5A,51B,58B,95C,139C 'lead':74B 'level':120C 'miss':117C 'modifi':100C 'multi':71B,110C 'multi-shop':70B,109C 'multistor':21B 'ownership':36B,122C 'password':54B,64B,135C,147C 'prestashop':1A,22B,27B,78C 'read':6A,53B,98C,129C 'record':39B,102C,119C 'record-level':118C 'request':153C 'result':154C 'runtim':23B 'saveentityfromxml':127C 'secur':57B,138C 'self':25B 'self-host':24B 'sensit':130C 'shop':11A,35B,67B,72B,106C,111C,121C 'shophasright':125C 'takeov':77B,157C 'updat':150C 'valid':48B 'via':148C 'vulner':88C 'webservic':3A,42B,49B,93C","nicknames":[],"mitigations":[],"who_affected":"Shops running PrestaShop older than 8.2.9 or 9.2.1 with the webservice API enabled and at least one API key issued, especially multi-shop installations where a key scoped to one shop can reach customer records of others. Single-shop installations without the webservice API in use are less exposed. The sources do not say whether a key with narrow permissions is enough to exploit it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","high","multistore","prestashop","runtime","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-71519':14A,17A 'across':10A 'api':4A 'chang':8A 'custom':9A 'cve':12A,15A 'key':5A 'prestashop':1A 'read':6A 'shop':11A 'webservic':3A","search_b":"'8.2.9':29B '9.2.1':31B 'account':76B 'across':65B 'api':43B,50B 'attack':45B 'chang':60B 'check':34B 'commerc':20B 'custom':38B,61B 'e':19B 'e-commerc':18B 'email':62B 'everi':66B 'fail':32B 'hash':55B 'hold':46B 'host':26B 'instal':73B 'key':51B,58B 'lead':74B 'multi':71B 'multi-shop':70B 'multistor':21B 'ownership':36B 'password':54B,64B 'prestashop':22B,27B 'read':53B 'record':39B 'runtim':23B 'secur':57B 'self':25B 'self-host':24B 'shop':35B,67B,72B 'takeov':77B 'valid':48B 'webservic':42B,49B","search_c":"'8.2.9':80C '9.2.1':82C 'access':86C 'account':156C 'allow':90C 'api':94C 'attack':113C 'authent':92C 'belong':103C 'broken':85C 'chang':141C 'check':123C 'contain':83C 'control':87C 'creat':149C 'custom':101C,131C,143C 'data':132C 'delet':152C 'email':145C 'exploit':115C 'hash':136C 'holder':96C 'instal':112C 'key':95C,139C 'level':120C 'miss':117C 'modifi':100C 'multi':110C 'multi-shop':109C 'ownership':122C 'password':135C,147C 'prestashop':78C 'read':98C,129C 'record':102C,119C 'record-level':118C 'request':153C 'result':154C 'saveentityfromxml':127C 'secur':138C 'sensit':130C 'shop':106C,111C,121C 'shophasright':125C 'takeov':157C 'updat':150C 'via':148C 'vulner':88C 'webservic':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:35:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-71519","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71519","severity":null,"published_at":"2026-11-13T23:17:19+00:00","modified_at":"2026-11-13T23:17:19+00:00","first_seen_at":"2026-11-13T23:35:11+00:00","fetched_at":"2026-11-13T23:35:11+00:00","note":null}],"documents":[{"id":151011,"url":"https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.9","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":151012,"url":"https://github.com/PrestaShop/PrestaShop/releases/tag/9.2.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":151013,"url":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hjwq-7qvv-qxj4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-09T12:35:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":151014,"url":"https://www.vulncheck.com/advisories/prestashop-webservice-api-authorization-bypass-via-id-shop-parameter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}