CVE-2026-110608

33th percentile - higher than 33% of all known CVEs

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.

An attacker can manipulate other users' orders, causing unauthorized cancellation or confirmation of receipt, leading to financial losses and order fulfilment disruptions.

Upgrade BizSpring Shop beyond commit cf22d39daaf1 if available, or implement ownership checks for orderId in the cancel and receive handlers. Ensure users can only act on their own orders.