Vulnerability · Published Oct 20, 2026 · Assigned by TYPO3

CVE-2026-113468Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

Medium 6.9

In plain English

A medium-severity missing authorization in Extension "TYPO3 Shop by coding.ms" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 61.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "TYPO3 Shop by coding.ms"	6.0.0 – before 6.3.05.0.0 – before 5.21.10 – before 4.9.4

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-036 vendor-advisory