Shopizer CVE-2026-110771

Requires an authenticated Shopizer customer account (PR:L) able to reach the REST API endpoint POST /api/v1/auth/products/{id}/reviews. The specific precondition is that the review-creation flow accepts a client-supplied customerId field and the PersistableProductReviewPopulator binds that value instead of deriving the reviewer identity from the authenticated session. Limiting factors: the attacker must hold valid credentials on the target store (no unauthenticated exploitation), impact is confined to review authorship and product rating integrity, and it affects Shopizer builds through 3.2.5. No special non-default configuration is required beyond a store exposing the customer review API.

This is a moderate-severity IDOR (CWE-639, authorization bypass through user-controlled customerId) with a CVSS 4.0 base score of 5.3. The vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation by an authenticated low-privilege customer with no user interaction, which is consistent with the description's 'authenticated customers.' Impact is correctly scoped to low integrity only (VI:L; VC:N/VA:N) - the flaw corrupts review authorship and product ratings but exposes no confidential data and causes no outage, so despite the network vector this is a data-integrity/trust issue rather than a system-compromise bug. No EPSS score was provided, the CVE is NOT on CISA KEV, and no explicit POC flag was supplied; therefore there is no evidence of active exploitation. However, a detailed public technical writeup (hackmd.io IDOR analysis) and a VulnCheck advisory describe the exact vulnerable endpoint and field, so the barrier to crafting an exploit is effectively trivial for any registered user. Net assessment: a real but low-urgency issue - genuine, easily exploitable by authenticated users, but limited blast radius (review/rating integrity) keeps it well below patch-now priority absent a specific trust/reputation concern.

An attacker registers or uses an existing customer account on a Shopizer store, then sends a crafted POST to /api/v1/auth/products/{id}/reviews with a customerId value belonging to a different customer. The server trusts the supplied customerId instead of the authenticated session identity, publishing the review and rating under the victim's name - enabling rating manipulation and impersonation. A public technical writeup detailing this exact IDOR exists, lowering the effort required, though no weaponized exploit is confirmed.