CVE-2026-115323
EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
evershopcommerce evershop
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.2.1evershopCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
Text from CVE List
Affected versions 2
- evershopaffected: 1.2.2 before 2.2.1CVE List
- evershopunaffected: 2.2.1CVE List
References 7
- github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941f7Fixvia CVE List
- github.com/evershopcommerce/evershop/releases/tag/v2.2.1Fixvia CVE List
- vulncheck.com/advisories/evershop-1.2.2-before-2.2.1-missing-authorization-via-customer-address-apiAdvisoryvia CVE List
- github.com/evershopcommerce/evershop/issues/928Referencevia CVE List
- github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomerAddress/updateCustomerAddress.jsReferencevia CVE List
- github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/deleteCustomerAddress/route.jsonReferencevia CVE List
- github.com/evershopcommerce/evershopReferencevia CVE List