Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-72843: EverShop allows anyone to hijack customer accounts
CVE-2026-72843 · published 14 days ago
Summary
EverShop’s API for updating a customer record does not check who is making the request. Anyone who knows a customer’s identifier can send a request that changes the email address and password, giving them full control of that account. Install the latest version of EverShop (or apply a patch that makes the endpoint require authentication) and avoid exposing customer identifiers in public links.
What to do
- Update evershopcommerce evershop to version 2.2.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| evershopcommerce | evershop | < 2.2.1 |
Original advisory text
The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware t...
The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to that record, hashing a password if one is provided, without verifying that the caller owns the record. An unauthenticated request carrying a known customer uuid can therefore overwrite that customer's email address and password and read back the updated record from the 200 response, taking over the account and locking out its owner. Customer uuids are exposed through order confirmation email links and administrative URLs. Version 2.2.1 changes the route to "access": "private".
References
- https://github.com/evershopcommerce/evershop/issues/952 issue-tracking
- https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/m... technical-description
- https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/m... technical-description
- https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1 release-notes
- https://github.com/evershopcommerce/evershop product
- https://www.vulncheck.com/advisories/evershop-missing-authorization-on-patch-api... third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-72843 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72843... Vendor Advisory
Severity
9.3
Critical
CVSS 3.1: 9.8 (MITRE)
CVSS 4.0: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-862Missing Authorization
Timeline
Published20 Aug 2026
Updated3 Sep 2026
First seen20 Aug 2026
Monitor software like this
Free during beta