CVE-2026-108696 in CoreShop
Summary
by MITRE • 10/11/2026
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm receipt of others' orders and overwrite return tracking details.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
CoreShop versions through 1.5.5 are affected by a critical authorization bypass vulnerability located within the OrderController component, specifically impacting the handling of order confirmation and reshipment processes. This flaw stems from an insufficient server-side validation mechanism that fails to enforce proper ownership checks when processing requests related to specific orders. The vulnerability allows authenticated users to manipulate system behavior by supplying user-controlled identifiers for resources they do not own, effectively bypassing access control restrictions designed to isolate customer data.
The technical root cause lies in the lack of binding between the session identity and the resource identifier provided in HTTP request parameters or payloads. When a client initiates actions such as confirming an order receipt via OrderConfirm or initiating a reshipment through SendReship, the application relies on external input for the target order ID without verifying that this ID corresponds to an entity associated with the currently authenticated user account. This design oversight enables attackers to craft malicious requests where they substitute their own legitimate identifiers with those belonging to other customers. By omitting required data fields in OrderConfirm or injecting arbitrary reshipment IDs into SendReship, an attacker can trick the system into processing actions on behalf of victims without proper authorization.
The operational impact of this vulnerability is significant and multifaceted, primarily affecting data integrity and confidentiality within e-commerce operations. Attackers who exploit this flaw can confirm receipt of orders belonging to other users, which may prematurely trigger refund processes or alter order status in ways that disrupt legitimate business workflows. Furthermore, the ability to overwrite return tracking details by supplying a different reshipId allows an attacker to manipulate logistics information, potentially leading to lost packages, incorrect inventory updates, and financial losses for both merchants and customers. This manipulation undermines trust in the platform’s transactional reliability and exposes sensitive customer data through unauthorized access patterns.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves failing to restrict actions based on user privileges or resource ownership. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, where the attacker leverages legitimate credentials to perform unauthorized operations due to flawed logic rather than credential theft. The specific action of modifying data belonging to another entity falls under CWE-653 Improper Privilege Management and CWE-918 Server-Side Request Forgery if the reshipment process involves external service calls, though primarily it is a direct authorization bypass affecting business logic integrity.
To mitigate this vulnerability, developers must implement strict server-side ownership verification for all order-related endpoints in the OrderController. This includes validating that the user ID associated with the active session matches the owner of the target order before processing any state-changing requests such as confirmations or reshipment updates. Input validation should be enforced to ensure that supplied identifiers are not only syntactically correct but also semantically valid within the context of the current user’s permissions. Additionally, implementing comprehensive logging and monitoring for anomalous access patterns can help detect exploitation attempts in real-time. Upgrading to a patched version of CoreShop where these authorization checks have been corrected is the most effective remediation strategy, alongside applying web application firewall rules that flag suspicious parameter manipulation on order endpoints.