evershopcommerce EverShop up to 2.2.0 Customer updateCustomer.js uuid authorization

Summaryinfo

A vulnerability identified as critical has been detected in evershopcommerce EverShop up to 2.2.0. This issue affects some unknown processing of the file updateCustomer.js of the component Customer. Performing a manipulation of the argument uuid results in authorization. This vulnerability is cataloged as CVE-2026-72843. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in evershopcommerce EverShop up to 2.2.0. This affects some unknown functionality of the file updateCustomer.js of the component Customer. The manipulation of the argument uuid with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to that record, hashing a password if one is provided, without verifying that the caller owns the record. An unauthenticated request carrying a known customer uuid can therefore overwrite that customer's email address and password and read back the updated record from the 200 response, taking over the account and locking out its owner. Customer uuids are exposed through order confirmation email links and administrative URLs. Version 2.2.1 changes the route to "access": "private".

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-72843 since 08/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 2.2.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• evershopcommerce

Name

• EverShop

Version

• 2.0
• 2.1
• 2.2.0

Website

• Product: https://github.com/evershopcommerce/evershop/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion