What is the CVSS score of CVE-2026-33674?

CVE-2026-33674 has a CVSS 3.1 base score of 2.0 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-33674?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

CVE-2026-33674

LOW

Improper Use of Validation Framework (CWE-1173)

2026-03-25 https://github.com/PrestaShop/PrestaShop

Information Disclosure

2.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.0 LOW

AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 25, 2026 - 19:47 vuln.today

CVE Published

Mar 25, 2026 - 19:40 nvd

LOW 2.0

DescriptionGitHub Advisory

Impact

Fix improper use of validation framework

Patches

Patched in 8.2.5 and 9.1.0

Workarounds

None

References

none

AnalysisAI

PrestaShop versions prior to 8.2.5 and 9.1.0 contain an improper use of validation framework vulnerability that allows information disclosure through integrity violations. An attacker with high privileges and user interaction can potentially bypass validation controls to access or modify sensitive information. The vulnerability has a low CVSS score of 2.0 reflecting limited real-world impact, though it represents a validation framework weakness in a widely-deployed e-commerce platform.

Technical ContextAI

The vulnerability (CWE-1173: Improper Use of Validation Framework) stems from improper implementation of PrestaShop's validation framework, which is responsible for enforcing business logic and data integrity controls in the application. The affected product is PrestaShop (composer package: prestashop/prestashop), a popular open-source e-commerce platform used by thousands of online merchants. CWE-1173 indicates that the validation framework was either bypassed, incorrectly applied, or failed to enforce necessary security checks on input or state transitions. This weakness is particularly significant in e-commerce systems where validation frameworks protect against unauthorized data manipulation and unauthorized information access.

RemediationAI

Upgrade PrestaShop to version 8.2.5 or later for the 8.x branch, or to version 9.1.0 or later for the 9.x branch. Administrators should prioritize this update as part of routine maintenance cycles, though it does not require emergency patching. No workarounds are available according to the vendor advisory, so patching is the only remediation path. Review the official security advisory at https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-283w-xf3q-788v for additional guidance and to verify compatibility with any custom extensions before deployment.