---
id: "CVE-2026-71519"
page: "https://infrastack.ai/live/CVE-2026-71519"
kind: "vulnerability"
aliases: ["CVE-2026-71519"]
title: "PrestaShop: a webservice API key reads and changes customers across shops"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["e-commerce", "multistore", "prestashop", "runtime", "self-hosted"]
not_affected_if: ["patched-version", "single-shop", "webservice-api-disabled"]
published_at: "2026-11-13T23:17:19+00:00"
first_seen_at: "2026-11-13T23:35:11+00:00"
updated_at: "2026-11-13T23:37:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71519", "first_seen_at": "2026-11-13T23:35:11+00:00"}]
exploit_sources: []
---

# PrestaShop: a webservice API key reads and changes customers across shops

Link for people: https://infrastack.ai/live/CVE-2026-71519 (this .md is for agents)

PrestaShop before 8.2.9 and 9.2.1 fails to check shop ownership of customer records in its webservice API. An attacker holding a valid webservice API key can read password hashes and secure keys and change customer emails and passwords across every shop in a multi-shop installation, leading to account takeover.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PrestaShop version in the back office or `composer show prestashop/prestashop` where applicable; versions below `8.2.9` on the 8.x line or below `9.2.1` on the 9.x line are in range.
- Check whether the Webservice API is enabled under Advanced Parameters > Webservice and list which API keys exist and what resources they can access.
- Check whether the installation runs multiple shops (Multistore enabled).

## Fix

- PrestaShop 8.x: upgrade to `8.2.9` or later.
- PrestaShop 9.x: upgrade to `9.2.1` or later.

## Timeline

- 2026-11-13T23:35:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-71519

## Documents

- [advisory] Vendor advisory: github.com https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-hjwq-7qvv-qxj4
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/prestashop-webservice-api-authorization-bypass-via-id-shop-parameter
- [fix] Release notes: github.com https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.9
- [fix] Release notes: github.com https://github.com/PrestaShop/PrestaShop/releases/tag/9.2.1

## From the sources

PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit the missing record-level shop ownership check in shopHasRight() and saveEntityFromXml() to read sensitive customer data such as password hashes and secure keys, and change a customer's email and password via create, update, and delete requests, resulting in account takeover.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_