CVE-2026-72843

{"id": "CVE-2026-72843", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72843", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T21:18:57.258144Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/evershopcommerce/evershop", "vendor": "evershopcommerce", "product": "evershop", "versions": [{"status": "affected", "version": "0", "lessThan": "2.2.1", "versionType": "semver"}, {"status": "unaffected", "version": "2.2.1", "versionType": "semver"}], "packageURL": "pkg:npm/evershop", "programFiles": ["packages/evershop/src/modules/customer/api/updateCustomer/route.json", "packages/evershop/src/modules/customer/api/updateCustomer/updateCustomer.js"], "defaultStatus": "unaffected"}]}], "published": "2026-08-20T22:18:05.253", "references": [{"url": "https://github.com/evershopcommerce/evershop", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomer/route.json", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomer/updateCustomer.js", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/evershopcommerce/evershop/issues/952", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/evershop-missing-authorization-on-patch-api-customers-id-allows-unauthenticated-account-takeover", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The customer update route in EverShop is declared with \"access\": \"public\" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to that record, hashing a password if one is provided, without verifying that the caller owns the record. An unauthenticated request carrying a known customer uuid can therefore overwrite that customer's email address and password and read back the updated record from the 200 response, taking over the account and locking out its owner. Customer uuids are exposed through order confirmation email links and administrative URLs. Version 2.2.1 changes the route to \"access\": \"private\"."}, {"lang": "es", "value": "La ruta de actualizaci\u00f3n de clientes en EverShop est\u00e1 declarada con 'access': 'public' en packages/evershop/src/modules/customer/api/updateCustomer/route.json, lo que provoca que el middleware de autenticaci\u00f3n de administrador llame a next() sin verificar al llamador, y ning\u00fan middleware de sesi\u00f3n de cliente protege la ruta; el \u00fanico middleware en la cadena analiza el cuerpo JSON. El gestor en updateCustomer.js luego carga al cliente por el uuid tomado de la ruta URL y escribe los campos proporcionados de nuevo en ese registro, aplicando hash a una contrase\u00f1a si se proporciona una, sin verificar que el llamador sea el propietario del registro. Una solicitud no autenticada que lleva un uuid de cliente conocido puede, por lo tanto, sobrescribir la direcci\u00f3n de correo electr\u00f3nico y la contrase\u00f1a de ese cliente y leer el registro actualizado de la respuesta 200, tomando el control de la cuenta y bloqueando a su propietario. Los uuids de cliente est\u00e1n expuestos a trav\u00e9s de enlaces de correo electr\u00f3nico de confirmaci\u00f3n de pedido y URLs administrativas. La versi\u00f3n 2.2.1 cambia la ruta a 'access': 'private'."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "disclosure@vulncheck.com"}