Read the docs

evershopcommerce

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

evershopcommerce records in CISA KEV

No evershopcommerce vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-51069 CVE-2026-72843 · GHSA-m3qj-pp48-6w2p

EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover

Priority MEDIUM 50

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without c…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00837 Published 2026-08-20 Fixed in 2.2.1 CWE-862
TI-2026-79260 CVE-2026-115323 · GHSA-9rjv-95rj-93cg

EverShop customer API missing authorization lets attackers change addresses

Priority LOW 36

EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00242 Published 2026-10-22 Fixed in 2.2.1 CWE-862
Open these records in search →