CVE-2026-108696
MediumCVSS 4.3Summary
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm receipt of others' orders and overwrite return tracking details.
Risk Assessment
The risk includes unauthorized access to other customers' orders and data modification, potentially leading to privacy breaches and transaction integrity issues.
Recommendation
Strengthen validation of order IDs and verify that the order belongs to the logged-in customer.
Other vulnerabilities in CoreShop
See all- CVE-2026-41249High
CoreShop versions 5.0.1 through 5.1.0-beta.1 have a GitHub Actions workflow vulnerability allowing external attackers to achieve RCE by submitting a malicious Pull Request. The workflow uses `pull_request_target` and dangerously checks out code from the PR head.
- CVE-2026-22242Medium
CoreShop prior to version 4.1.8 contains a blind SQL injection vulnerability that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible.
Original NVD description (English source)
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm receipt of others' orders and overwrite return tracking details.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS