Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck

CVE-2026-115323EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API

High 7.3

In plain English

A high-severity missing authorization in evershop from evershopcommerce. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.2%top 84.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.

Affected products (as reported)

Vendor	Product	Versions
evershopcommerce	evershop	1.2.2 – before 2.2.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/evershopcommerce/evershop/issues/928 issue-tracking
https://github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941f7 patch
v2.2.1 Release Notes release-notes
https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomerAddress/updateCustomerAddress.js technical-description
https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/deleteCustomerAddress/route.json technical-description
https://github.com/evershopcommerce/evershop product
VulnCheck Advisory: EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API third-party-advisory