High severity · published Oct 22, 2026
CVE-2026-115323
EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
New
7.3
CVSS
0.2%
EPSS
No
On KEV
Description
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EV
evershop · evershopcommerce
1.2.2 before 2.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115323
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115323
github.com
https://github.com/evershopcommerce/evershop
github.com
https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/deleteCustomerAddress/route.json
github.com
https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomerAddress/updateCustomerAddress.js
github.com
https://github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941f7
github.com
https://github.com/evershopcommerce/evershop/issues/928
github.com
https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1
More from evershop
9.8
CVE-2026-72843
EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover
9.8
CVE-2026-28213
EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response
9.8
CVE-2026-25993
EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys