# CVE-2026-72843: EverShop customer update authentication bypass

Source: https://junglewise.ai/threats/cve-2026-72843-evershop-customer-update-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72843 · Severity: critical · CVSS 9.8 · Published 2026-08-20

EverShop is an open-source e-commerce platform. The customer account update API endpoint is publicly accessible without authentication, allowing an attacker with knowledge of a customer's account ID to change their email address and password, thereby taking over the account and locking out the legitimate owner. Customer IDs are exposed in order confirmation emails and admin interfaces, making this attack practical.

Technologies: [EverShop](https://junglewise.ai/threats/technologies/evershop). Vendors: [EverShop](https://junglewise.ai/threats/vendors/evershop).

## Quick answers

**Is CVE-2026-72843 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72843 being exploited in the wild.

**How severe is CVE-2026-72843?** Critical severity, with a CVSS score of 9.8, published 20 August 2026.

**Which products and versions are affected?** EverShop before 2.2.1.

**Is there a fix for CVE-2026-72843?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-72843 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-72843?** Check whether you run EverShop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in the customer update route (PATCH /customers/:id) declared with "access": "public" in route.json. The route lacks customer-session middleware validation and the updateCustomer.js handler does not verify that the caller owns the customer record being modified. An unauthenticated attacker can supply a known customer UUID in the URL path and overwrite the customer's email and password fields; the response reflects the updated record, confirming account takeover. Customer UUIDs are readily available from order confirmation email links and administrative URLs. The issue is fixed in version 2.2.1 by changing the route access level to "private", which enforces proper authentication middleware.

## Affected products

- EverShop EverShop before 2.2.1

## Timeline

- 2026-08-20: disclosed: CVE-2026-72843 published

## References

- [https://github.com/evershopcommerce/evershop](https://github.com/evershopcommerce/evershop)
- [https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomer/route.json](https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomer/route.json)

## Related threats

- [EverShop missing authorization in customer address API](https://junglewise.ai/threats/cve-2026-115323-evershop-1-2-2-before-2-2-1-contains-a-missing-authorization)
- [EverShop server-side request forgery in images API](https://junglewise.ai/threats/cve-2025-67427-evershop-server-side-request-forgery-in-images-api)
- [EverShop denial of service in image processing API](https://junglewise.ai/threats/cve-2025-67419-evershop-denial-of-service-in-image-processing-api)
- [EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via the…](https://junglewise.ai/threats/cve-2025-65844-evershop-2-0-1-allows-a-remote-unauthenticated-attacker-to-upload)
- [EverShop IDOR in Order Handler](https://junglewise.ai/threats/cve-2025-12919-evershop-idor-in-order-handler)