CVE-2026-71531

HIGH 8.1

PrestaShop Webservice API Authorization Bypass via id_shop Parameter

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key restricted to one shop to act on data of every shop by submitting requests with id_shop=all or id_shop_group=N, which expand the shop context without validating the key's actual shop associations and cause shopHasRight() to evaluate the expanded set as a disjunction. Attackers can exploit this flaw via classes/webservice/WebserviceRequest.php to read, modify, or delete data belonging to shops they are not authorized for, including full customer records such as email addresses, secure_key, and password hashes across the installation.

CWE	CWE-863
Vendor	prestashop
Product	prestashop
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for prestashop prestashop

Be the first to know when new high vulnerabilities affecting prestashop prestashop are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

PrestaShop / PrestaShop

0 < 8.2.9 9.0.0 < 9.2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3f36-4qv4-vfgh github.com: https://github.com/PrestaShop/PrestaShop/releases/tag/9.2.1 github.com: https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.9 vulncheck.com: https://www.vulncheck.com/advisories/prestashop-webservice-api-authorization-bypass-via-id-shop-parameter

Credits

CodeAnt AI Security Research Team Sakil Ahamed Gayen Gurvir Bajwa