TYPO3 Shop Extension CVE-2026-112071

Exploitation requires that the site has published a page containing the shop's order/cancellation plugin from the coding.ms typo3_shop extension - without that exposed plugin the cancellation endpoint is not reachable. No authentication is needed (CVSS PR:N) and no user interaction (UI:N); the attacker simply supplies an order identifier they do not own. The key limiting factor is impact scope: only orders in the 'awaiting payment' state can be canceled, while already-paid orders are explicitly unaffected, so damage is confined to disrupting pending, unpaid transactions. The attacker must also reference valid order identifiers (guessed or enumerated) for the cancellation to have effect.

This is a missing-authorization flaw (CWE-862, an IDOR-style access-control gap) in the coding.ms 'typo3_shop' TYPO3 extension. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated action requiring no user interaction, which inflates the raw score to 6.9; however the impact is deliberately narrow - only VI:L (limited integrity), with no confidentiality (VC:N) and no availability (VA:N) effect, and no scope change. The real-world harm is bounded: an attacker can flip orders that are still awaiting payment to 'canceled', but paid orders are explicitly unaffected and no data is read or exfiltrated. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so there is no public exploit identified at time of analysis. Net judgment: this is a genuine but moderate business-logic/integrity issue rather than a top-priority security emergency - easy to trigger but limited to disrupting unpaid order state on sites that expose the shop's order plugin on a page. The input Tag labels this 'Authentication Bypass', which is imprecise: no authentication is bypassed - authorization is simply never checked (missing ownership verification), consistent with CWE-862; verify framing with the vendor advisory.

An unauthenticated visitor browses to a page that embeds the shop's order plugin and submits the cancellation request while substituting arbitrary order identifiers belonging to other customers. Because the server never verifies that the caller owns the referenced order, any order still awaiting payment is set to 'canceled'. No public exploit code is identified at time of analysis, and the attack requires only a crafted request with low complexity (AC:L) and no privileges or user interaction.