Is CVE-2026-108696 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108696 being exploited in the wild.

How severe is CVE-2026-108696?

Medium severity, with a CVSS score of 4.3, published 11 October 2026.

Which products and versions are affected?

CoreUnion CoreShop through 1.5.5.

Is there a fix for CVE-2026-108696?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108696 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108696?

Check whether you run CoreUnion CoreShop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108696: CoreShop authorization bypass in OrderController

CVE-2026-108696 · Severity: medium · CVSS 4.3 · Published 2026-10-11

CoreShop is an e-commerce platform built on ASP.NET Core that manages online orders and customer transactions. An authentication bypass vulnerability in the OrderController allows logged-in customers to manipulate other customers' orders by changing order IDs, potentially confirming receipts, overwriting tracking details, or triggering unintended actions on orders they do not own.

Technologies: CoreUnion CoreShop. Vendors: CoreUnion.

Quick answers

Is CVE-2026-108696 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108696 being exploited in the wild.
How severe is CVE-2026-108696?: Medium severity, with a CVSS score of 4.3, published 11 October 2026.
Which products and versions are affected?: CoreUnion CoreShop through 1.5.5.
Is there a fix for CVE-2026-108696?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108696 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108696?: Check whether you run CoreUnion CoreShop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The OrderController in CoreShop through 1.5.5 fails to validate that authenticated users own the orders they are operating on, allowing arbitrary order IDs to be supplied in requests. An attacker can omit required fields in OrderConfirm or supply arbitrary shipment IDs to SendReship to confirm or modify orders belonging to other customers, compromising order integrity and customer data.

Affected products

CoreUnion CoreShop through 1.5.5

Timeline

2026-10-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.