PrestaShop up to 8.2.8/9.2.0 Webservice API WebserviceRequest.php shopHasRight id_shop/id_shop_group improper authorization

Summaryinfo

A vulnerability was found in PrestaShop up to 8.2.8/9.2.0. It has been rated as critical. The impacted element is the function shopHasRight of the file classes/webservice/WebserviceRequest.php of the component Webservice API. Performing a manipulation of the argument id_shop/id_shop_group results in improper authorization. This vulnerability is reported as CVE-2026-71531. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in PrestaShop up to 8.2.8/9.2.0. This affects the function shopHasRight of the file classes/webservice/WebserviceRequest.php of the component Webservice API. The manipulation of the argument id_shop/id_shop_group with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key restricted to one shop to act on data of every shop by submitting requests with id_shop=all or id_shop_group=N, which expand the shop context without validating the key's actual shop associations and cause shopHasRight() to evaluate the expanded set as a disjunction. Attackers can exploit this flaw via classes/webservice/WebserviceRequest.php to read, modify, or delete data belonging to shops they are not authorized for, including full customer records such as email addresses, secure_key, and password hashes across the installation.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-71531 since 08/06/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

By approaching the search of inurl:classes/webservice/WebserviceRequest.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 8.2.9 or 9.2.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Name

• PrestaShop

Version

• 8.2.0
• 8.2.1
• 8.2.2
• 8.2.3
• 8.2.4
• 8.2.5
• 8.2.6
• 8.2.7
• 8.2.8
• 9.0
• 9.1
• 9.2.0

License

• open-source

Website

• Product: https://github.com/PrestaShop/PrestaShop/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion