Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108696CoreShop through 1.5.5 Authorization Bypass via OrderController OrderConfirm and SendReship

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in CoreShop from CoreUnion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 87.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm receipt of others' orders and overwrite return tracking details.

Affected products (as reported)

Vendor	Product	Versions
CoreUnion	CoreShop	0 – through 1.5.5

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SkVjopPsGe third-party-advisory
https://github.com/CoreUnion/CoreShop/blob/ca7408b025bc5f3fd5957a79618ffe991c4e91ab/CoreCms.Net.Web.WebApi/Controllers/OrderController.cs#L281-L294 technical-description
https://github.com/CoreUnion/CoreShop/blob/ca7408b025bc5f3fd5957a79618ffe991c4e91ab/CoreCms.Net.Web.WebApi/Controllers/OrderController.cs#L422-L458 technical-description
https://github.com/CoreUnion/CoreShop/blob/ca7408b025bc5f3fd5957a79618ffe991c4e91ab/CoreCms.Net.Services/Order/CoreCmsOrderServices.cs#L2048-L2060 technical-description
https://github.com/CoreUnion/CoreShop product
VulnCheck Advisory: CoreShop through 1.5.5 Authorization Bypass via OrderController OrderConfirm and SendReship third-party-advisory