Authorization bypass in CoreShop lets customers act on others' orders
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
CoreUnion CoreShop through 1.5.5 contains an authorization bypass in the OrderController, tracked as CWE-639. The flaw trusts user-controlled ids, so an authenticated customer can act on other customers' orders. An attacker can confirm receipt of others' orders and overwrite their return tracking details.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm receipt of others' orders and overwrite return tracking details.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for CoreShop.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108696
- 2026-10-11 Alias added: GHSA-7jj7-hfg8-m26w
- 2026-10-13 CISA SSVC decision points changed
References
Other 4
- https://github.com/CoreUnion/CoreShop/blob/ca7408b025bc5f3fd5957a79618ffe991c4e91ab/CoreCms.Net.Web.WebApi/Controllers/OrderController.cs#L281-L294
- https://github.com/CoreUnion/CoreShop/blob/ca7408b025bc5f3fd5957a79618ffe991c4e91ab/CoreCms.Net.Web.WebApi/Controllers/OrderController.cs#L422-L458
- https://github.com/CoreUnion/CoreShop/blob/ca7408b025bc5f3fd5957a79618ffe991c4e91ab/CoreCms.Net.Services/Order/CoreCmsOrderServices.cs#L2048-L2060
- https://github.com/CoreUnion/CoreShop
More CoreUnion vulnerabilities
- TI-2026-83130 SQL injection in CoreShop order parameter lets attackers extract data CVSS 4.0HIGH 8.7
- TI-2026-83129 SQL injection in CoreShop GetGoodsPageList via order parameter CVSS 4.0HIGH 8.7
Sources
- CVE-2026-108696 · CVE Program
- CVE-2026-108696 · NVD
- FIRST EPSS
- GHSA-7jj7-hfg8-m26w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences