CVE-2026-72843
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
In EverShop, the customer update route is declared as public, causing the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route. An unauthenticated request with a known customer uuid can overwrite the customer's email and password, taking over the account. Version 2.2.1 changes the route to private.
Risk Assessment
An unauthenticated attacker can take over customer accounts, potentially leading to theft of personal data and unauthorized actions in the system.
Recommendation
Update EverShop to version 2.2.1 or later, which changes the route to private, and review logs for unauthorized account changes.
Other vulnerabilities in EverShop
See all- CVE-2025-67419High
A DoS vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust application server resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during SVG processing, resulting in unbounded resource consumption and system-wide denial of service.
- CVE-2026-115323High
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
- CVE-2025-12919Low
In EverShop up to 2.0.1, manipulation of the uuid argument in Order.resolvers.js of the Order Handler component results in improper control of resource identifiers. The attack can be performed remotely, is of high complexity and difficult exploitability, and the exploit is public.
Original NVD description (English source)
The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to that record, hashing a password if one is provided, without verifying that the caller owns the record. An unauthenticated request carrying a known customer uuid can therefore overwrite that customer's email address and password and read back the updated record from the 200 response, taking over the account and locking out its owner. Customer uuids are exposed through order confirmation email links and administrative URLs. Version 2.2.1 changes the route to "access": "private".
Vulnerability data from NVD (NIST) · CISA KEV · EPSS