Executive brief
EverShop is an open-source e-commerce platform. The customer account update API endpoint is publicly accessible without authentication, allowing an attacker with knowledge of a customer's account ID to change their email address and password, thereby taking over the account and locking out the legitimate owner. Customer IDs are exposed in order confirmation emails and admin interfaces, making this attack practical.
Technical details
The vulnerability is an authentication bypass in the customer update route (PATCH /customers/:id) declared with "access": "public" in route.json. The route lacks customer-session middleware validation and the updateCustomer.js handler does not verify that the caller owns the customer record being modified. An unauthenticated attacker can supply a known customer UUID in the URL path and overwrite the customer's email and password fields; the response reflects the updated record, confirming account takeover. Customer UUIDs are readily available from order confirmation email links and administrative URLs. The issue is fixed in version 2.2.1 by changing the route access level to "private", which enforces proper authentication middleware.
Affected products
- EverShop EverShop before 2.2.1
Timeline
- 2026-08-20: disclosed: CVE-2026-72843 published