CVE-2026-110771 in Shopizer
Summary
by MITRE • 10/14/2026
Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The Shopizer e-commerce platform version 3.2.5 exhibits a critical authorization bypass vulnerability within its API endpoint for submitting product reviews. This flaw stems from an insecure direct object reference implementation where the application fails to validate that the user initiating the request is the same entity identified by the customerId parameter provided in the payload. Instead of deriving the author identity strictly from the authenticated session token or context, the system trusts client-supplied input without sufficient server-side verification against the current principal's credentials. This architectural oversight allows any authenticated customer to manipulate the ownership of review data by injecting arbitrary identifiers into the request body.
From a technical perspective, this vulnerability is classified under CWE-284 Improper Access Control and aligns with MITRE ATT&CK technique T1078 Valid Accounts, as it leverages legitimate credentials to perform unauthorized actions beyond their intended scope. The specific mechanism involves sending crafted HTTP POST requests to the /api/v1/auth/products/{id}/reviews endpoint while including a customerId field that corresponds to a different user account within the database. Because the backend logic accepts this parameter and associates the new review with the specified ID rather than the session owner, it effectively bypasses identity verification checks. This represents a classic case of horizontal privilege escalation where one authenticated user can impersonate another peer-level user without requiring elevated system privileges or administrative access.
The operational impact of this vulnerability is significant for both platform integrity and consumer trust. Attackers can corrupt product ratings by posting positive reviews under the identities of trusted customers, thereby artificially inflating scores to boost specific products in search rankings and recommendation algorithms. Conversely, malicious actors could post negative reviews attributed to competitors or rival accounts to damage reputations and drive down sales figures. This manipulation undermines the reliability of user-generated content which is a primary driver for purchase decisions on e-commerce sites. Furthermore, it compromises data integrity by creating false audit trails that attribute actions to users who did not perform them, complicating forensic investigations and dispute resolution processes if such fraudulent activities are later detected.
Mitigation strategies must focus on enforcing strict server-side validation of user identity during all state-changing operations. The application should be updated to ignore any customerId fields provided in the request payload for review submissions and instead derive this value exclusively from the authenticated session context or JWT claims associated with the active token. Implementing robust access control checks that verify the requesting entity has permission to act on behalf of the target resource is essential. Additionally, adopting principle of least privilege and ensuring that API endpoints do not expose internal identifiers in a way that allows for easy manipulation will reduce the attack surface. Regular security testing including automated penetration tests focused on broken object level authorization flaws should be integrated into the development lifecycle to detect similar issues before deployment.