CVE-2026-39250

HighCVSS 7.3

Published: 19/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Innoshop 0.6.0 has an authorization vulnerability. After logging into the frontend, an attacker can directly access backend application interfaces, leading to further dangerous operations.

Risk Assessment

An attacker can bypass authorization mechanisms and perform administrative operations, such as data modification or privilege escalation, without proper permissions.

Recommendation

Immediately upgrade Innoshop to a version that includes an authorization fix. If not available, implement additional access controls at the web server level.

Other vulnerabilities in Innoshop

CVE-2026-18959Medium
InnoShop up to version 0.8.2 contains a path traversal vulnerability in the FileManagerController::destroyFiles function in the Files Endpoint component. The attack can be initiated remotely, and an exploit has been published.

Original NVD description (English source)

An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an attacker can directly access backend application interfaces, leading to further dangerous operations.