# CVE-2023-46498: EverShop authorization bypass in deleteCustomer endpoint

Source: https://junglewise.ai/threats/cve-2023-46498-evershop-authorization-bypass-in-deletecustomer-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-12-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-46498 · Severity: low · CVSS 3.1 · Published 2023-12-08

EverShop is a TypeScript-based e-commerce platform. A vulnerability in versions before 1.0.0-rc.8 allows unauthenticated attackers to delete customer accounts and access sensitive information through an unprotected GraphQL endpoint. This could result in widespread account deletion, customer data exposure, and service disruption for merchants using the platform.

Technologies: [EverShop](https://junglewise.ai/threats/technologies/evershop), [@evershop/evershop (npm)](https://junglewise.ai/threats/technologies/evershop-evershop). Vendors: [EverShop](https://junglewise.ai/threats/vendors/evershop), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-46498 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-46498 being exploited in the wild.

**How severe is CVE-2023-46498?** Low severity, with a CVSS score of 3.1, published 8 December 2023.

**Which products and versions are affected?** EverShop < 1.0.0-rc.8; @evershop/evershop (npm) SEMVER:introduced=0,fixed=1.0.0-rc.8.

**Is there a fix for CVE-2023-46498?** Yes. @evershop/evershop (npm): upgrade to 1.0.0-rc.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-46498 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-46498?** Check whether you run EverShop or @evershop/evershop (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @evershop/evershop (npm): upgrade to 1.0.0-rc.8 or later

  ```sh
  npm install @evershop/evershop@1.0.0-rc.8
  ```


## Technical details

The vulnerability is a broken function-level authorization (CWE-285) issue in the route.json configuration of EverShop's GraphQL endpoint. The /deleteCustomer endpoint lacks proper authentication checks, allowing any network-accessible attacker to send DELETE requests without credentials. An attacker can chain this with GraphQL schema introspection to enumerate customer UUIDs, then execute unauthorized deletions of customer accounts. The vulnerability also permits access to sensitive customer information. The issue was fixed in version 1.0.0-rc.8 by implementing authentication requirements (admin credentials) for the endpoint. The patch is available in GitHub pull request #342.

## Affected products

- EverShop @evershop/evershop < 1.0.0-rc.8

## Identifiers

- CVE-2023-46498
- GHSA-5mmr-9qx3-3pf9

## Timeline

- 2023-12-08: disclosed: Vulnerability published in GitHub Security Advisory GHSA-5mmr-9qx3-3pf9
- 2023-10-01: patched: Fix merged in PR #342 to v1.0.0-rc.8
- 2023-09-25: other: Vulnerability initially reported/discovered

## References

- [https://github.com/evershopcommerce/evershop/pull/342](https://github.com/evershopcommerce/evershop/pull/342)
- [https://devhub.checkmarx.com/cve-details/Cx8b24ace3-0c9a](https://devhub.checkmarx.com/cve-details/Cx8b24ace3-0c9a)
- [https://devhub.checkmarx.com/cve-details/cve-2023-46498](https://devhub.checkmarx.com/cve-details/cve-2023-46498)
- [https://github.com/evershopcommerce/evershop](https://github.com/evershopcommerce/evershop)

## Related threats

- [EverShop missing authorization in customer address API](https://junglewise.ai/threats/cve-2026-115323-evershop-1-2-2-before-2-2-1-contains-a-missing-authorization)
- [EverShop customer update authentication bypass](https://junglewise.ai/threats/cve-2026-72843-evershop-customer-update-authentication-bypass)
- [EverShop server-side request forgery in images API](https://junglewise.ai/threats/cve-2025-67427-evershop-server-side-request-forgery-in-images-api)
- [EverShop denial of service in image processing API](https://junglewise.ai/threats/cve-2025-67419-evershop-denial-of-service-in-image-processing-api)
- [EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the…](https://junglewise.ai/threats/cve-2025-65844-evershop-2-0-1-allows-a-remote-unauthenticated-attacker-to-upload)