Vulnerability · Published Oct 20, 2026 · Assigned by TYPO3

CVE-2026-112071Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

Medium 6.9

In plain English

A medium-severity missing authorization in Extension "TYPO3 Shop by coding.ms" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 61.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "TYPO3 Shop by coding.ms"	6.0.0 – before 6.3.05.0.0 – before 5.21.10 – before 4.9.4

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-036 vendor-advisory