PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-115323 evershopcommerce CVE debrief

The CVE-2026-115323 vulnerability in EverShop versions 1.2.2 before 2.2.1 allows unauthenticated attackers to manage other customers' addresses via the customer address API. This missing authorization issue poses a risk to data integrity and confidentiality. Defenders should assess exposure and implement compensating controls to prevent unauthorized address management. The vulnerability was published on 2026-10-22T10:57:42.424Z and has not been modified since then. The NVD entry is currently Medium.

Vendor
evershopcommerce
Product
evershop
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-29
Advisory published
2026-10-22
Advisory updated
2026-10-29

Who should care

Defenders responsible for EverShop instances, particularly those using versions before 2.2.1, should assess exposure and implement compensating controls to prevent unauthorized address management.

Why it matters

The missing authorization vulnerability in EverShop's customer address API allows unauthenticated attackers to manage other customers' addresses, posing a risk to data integrity and confidentiality.

  • Verify exposure of EverShop instances to the customer address API
  • Implement compensating controls to restrict access to the API
  • Monitor for suspicious activity related to customer address management

Technical summary

The EverShop customer address API is vulnerable to missing authorization, allowing unauthenticated attackers to manage other customers' addresses by sending POST, PATCH, or DELETE requests to specific routes. This vulnerability affects EverShop versions 1.2.2 before 2.2.1. Defenders should prioritize verifying exposure and implementing compensating controls for unauthenticated address management in EverShop instances before version 2.2.1. The vulnerability allows attackers who know customer and address UUIDs to add, modify, or delete saved shipping addresses.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls for unauthenticated address management in EverShop instances before version 2.2.1.

Recommended defensive actions

  • Verify EverShop instance versions and exposure to the customer address API
  • Implement compensating controls, such as restricting access to the customer address API
  • Monitor for suspicious activity related to customer address management
  • Update to version 2.2.1 or later if possible
  • Review and validate vendor guidance for patching
  • Conduct an exposure review for affected EverShop instances
  • Track and monitor asset inventory for potential impacts

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in EverShop's customer address API. The vulnerability allows unauthenticated attackers to manage other customers' addresses by sending POST, PATCH, or DELETE requests to specific routes.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-115323 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-115323

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-115323 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-115323

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/115xxx/CVE-2026-115323.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/evershopcommerce/evershop/issues/928

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941f7

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomerAddress/updateCustomerAddress.js

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/deleteCustomerAddress/route.json

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/evershopcommerce/evershop

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/evershop-1.2.2-before-2.2.1-missing-authorization-via-customer-address-api

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.