Is CVE-2026-72843 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72843 being exploited in the wild.

How severe is CVE-2026-72843?

Critical severity, with a CVSS score of 9.8, published 20 August 2026.

Is there a fix for CVE-2026-72843?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-72843 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-72843?

Check whether you run EverShop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72843: EverShop customer update authentication bypass

CVE-2026-72843 · Severity: critical · CVSS 9.8 · Published 2026-08-20

EverShop is an open-source e-commerce platform. The customer account update API endpoint is publicly accessible without authentication, allowing an attacker with knowledge of a customer's account ID to change their email address and password, thereby taking over the account and locking out the legitimate owner. Customer IDs are exposed in order confirmation emails and admin interfaces, making this attack practical.

Technologies: EverShop. Vendors: EverShop.

Quick answers

Is CVE-2026-72843 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72843 being exploited in the wild.
How severe is CVE-2026-72843?: Critical severity, with a CVSS score of 9.8, published 20 August 2026.
Which products and versions are affected?: EverShop before 2.2.1.
Is there a fix for CVE-2026-72843?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-72843 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-72843?: Check whether you run EverShop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass in the customer update route (PATCH /customers/:id) declared with "access": "public" in route.json. The route lacks customer-session middleware validation and the updateCustomer.js handler does not verify that the caller owns the customer record being modified. An unauthenticated attacker can supply a known customer UUID in the URL path and overwrite the customer's email and password fields; the response reflects the updated record, confirming account takeover. Customer UUIDs are readily available from order confirmation email links and administrative URLs. The issue is fixed in version 2.2.1 by changing the route access level to "private", which enforces proper authentication middleware.

Affected products

EverShop EverShop before 2.2.1

Timeline

2026-08-20: disclosed: CVE-2026-72843 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.