CVE-2026-115323
EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
CVSS Score
7.3
EPSS Score
0.0%
EPSS Percentile
0th
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
| CWE | CWE-862 |
| Vendor | evershopcommerce |
| Product | evershop |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for evershopcommerce evershop
Be the first to know when new high vulnerabilities affecting evershopcommerce evershop are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
evershopcommerce / evershop
1.2.2 < 2.2.1
References
github.com: https://github.com/evershopcommerce/evershop/issues/928 github.com: https://github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941f7 github.com: https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1 github.com: https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomerAddress/updateCustomerAddress.js github.com: https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/deleteCustomerAddress/route.json github.com: https://github.com/evershopcommerce/evershop vulncheck.com: https://www.vulncheck.com/advisories/evershop-1.2.2-before-2.2.1-missing-authorization-via-customer-address-api
Credits
Proscan-one (ProScan AppSec) 🔍 leediay153 from Viettel Post