EUVD-2026-63730
GHSA-m3qj-pp48-6w2p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N); full read/overwrite of the account gives C:H/I:H and owner lockout via password reset gives A:H.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to that record, hashing a password if one is provided, without verifying that the caller owns the record. An unauthenticated request carrying a known customer uuid can therefore overwrite that customer's email address and password and read back the updated record from the 200 response, taking over the account and locking out its owner. Customer uuids are exposed through order confirmation email links and administrative URLs. Version 2.2.1 changes the route to "access": "private".
AnalysisAI
Unauthenticated account takeover in EverShop (all versions before 2.2.1) stems from the customer update API (PATCH /api/customers/:id) being declared "access": "public", which causes the admin auth middleware to pass every caller through and leaves no customer-session guard on the route. Any remote attacker who knows a customer's uuid can overwrite that account's email and password and read the updated record from the 200 response, hijacking the account and locking out the legitimate owner. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The only prerequisite is knowledge of a valid target customer uuid used in the URL path of PATCH /api/customers/:id; no authentication, session, token, or user interaction is required because the route is declared "access": "public" and no customer-session middleware guards it in versions before 2.2.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker harvests a target customer's uuid from an order-confirmation email link or an exposed administrative/storefront URL, then sends a single unauthenticated PATCH request to /api/customers/<uuid> setting a new email and password. The server hashes and stores the attacker's password and returns the updated record in the 200 response, giving the attacker full control of the account while the original owner is locked out; because the vector is AV:N/AC:L/PR:N/UI:N, no authentication, tooling, or victim interaction is needed and no POC is required to reproduce it. |
| Remediation | Vendor-released patch: 2.2.1 - upgrade to EverShop 2.2.1 or later, which changes the customer update route to "access": "private" so the endpoint requires an authenticated customer session (release: https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running EverShop and confirm current deployment versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today