EverShop CVE-2026-72843

The only prerequisite is knowledge of a valid target customer uuid used in the URL path of PATCH /api/customers/:id; no authentication, session, token, or user interaction is required because the route is declared "access": "public" and no customer-session middleware guards it in versions before 2.2.1. Exploitation is limited in practice only by the attacker's ability to obtain a specific customer's uuid - these are not high-entropy secrets and, per the advisory, are exposed via order-confirmation email links and administrative URLs, so the limiting factor is weak. Non-default configuration is NOT required: default deployments of EverShop below 2.2.1 are affected.

All signals point to genuine high priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects a network-reachable, low-complexity, no-privilege, no-interaction attack with high confidentiality, integrity and availability impact to the affected account - consistent with the described unauthenticated overwrite-and-read behavior. The single limiting factor is that the attacker must possess a valid customer uuid; however the description notes uuids leak through order-confirmation email links and administrative URLs, and uuids are per-record identifiers rather than secrets, so this is a weak barrier. No EPSS score, KEV listing, or POC flag was provided: the flaw is not confirmed as actively exploited and no public exploit is identified, so the risk is driven by ease of exploitation rather than observed in-the-wild activity. No signals are contradictory; the main uncertainty is exploitation prevalence in the wild, not exploitability.

An attacker harvests a target customer's uuid from an order-confirmation email link or an exposed administrative/storefront URL, then sends a single unauthenticated PATCH request to /api/customers/<uuid> setting a new email and password. The server hashes and stores the attacker's password and returns the updated record in the 200 response, giving the attacker full control of the account while the original owner is locked out; because the vector is AV:N/AC:L/PR:N/UI:N, no authentication, tooling, or victim interaction is needed and no POC is required to reproduce it.