Which versions of InnoShop are affected by CVE-2026-7630?

InnoShop e-commerce platform versions up to 0.7.8 contain an authentication bypass vulnerability in the installation endpoint that allows unauthenticated attackers to access setup functionality after…. A patch is available.

Is there a public PoC exploit available for CVE-2026-7630?

Yes, a public proof-of-concept exploit is available for CVE-2026-7630. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-7630?

Within 24 hours: Identify all InnoShop installations running versions 0.7.8 or earlier and verify they are accessible only to authorized administrators via network segmentation or WAF rules. Within 7 days: Apply vendor patch commit 45758e4ec22451ab944ae2ae826b1e70f6450dc9 to all affected instances and validate installation endpoints are no longer accessible without proper authentication. Within 30 days: Conduct access logs review for the past 90 days to detect any unauthorized installation endpoint access attempts and implement continuous monitoring for installation endpoint abuse.

InnoShop CVE-2026-7630

Q: What is the CVSS score of CVE-2026-7630?

CVE-2026-7630 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-26792 MEDIUM

Improper Authentication (CWE-287)

2026-05-02 VulDB

Authentication Bypass PHP

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 02, 2026 - 14:22 NVD

HIGH MEDIUM

CVSS changed

May 02, 2026 - 14:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

PoC Detected

May 02, 2026 - 14:16 vuln.today

Public exploit code

Source Code Evidence Fetched

May 02, 2026 - 14:00 vuln.today

Analysis Generated

May 02, 2026 - 14:00 vuln.today

EUVD ID Assigned

May 02, 2026 - 13:30 euvd

EUVD-2026-26792

Analysis Generated

May 02, 2026 - 13:30 vuln.today

Patch released

May 02, 2026 - 13:30 nvd

Patch available

CVE Published

May 02, 2026 - 13:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability has been found in innocommerce InnoShop up to 0.7.8. The affected element is the function InstallServiceProvider::boot of the file innopacks/install/src/InstallServiceProvider.php of the component Installation Endpoint. The manipulation leads to improper authentication. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 45758e4ec22451ab944ae2ae826b1e70f6450dc9. It is recommended to apply a patch to fix this issue.

AnalysisAI

InnoShop e-commerce platform versions up to 0.7.8 allow unauthenticated remote attackers to bypass authentication controls in the installation endpoint via improper authentication handling in InstallServiceProvider::boot. The vulnerability permits unauthorized access to installation functionality even after initial setup is complete, enabling attackers to achieve partial confidentiality, integrity, and availability impact. Publicly available exploit code exists (GitHub issue #314), and vendor has released patch commit 45758e4ec22451ab944ae2ae826b1e70f6450dc9.

Technical ContextAI

The vulnerability resides in InnoShop's PHP-based installation service provider (innopacks/install/src/InstallServiceProvider.php). The InstallServiceProvider::boot function in versions up to 0.7.8 fails to verify whether the installation process has already been completed before registering installation routes and functionality. This represents CWE-287 (Improper Authentication) - the application does not properly enforce authentication checks to ensure installation endpoints are disabled post-deployment. The patch introduces a has_install_lock() guard check that returns early if installation lock file exists, preventing re-registration of installation functionality. This is a common pattern failure in web application installers where setup endpoints remain accessible after initial configuration, creating persistent backdoor-like access to privileged functionality.

RemediationAI

Apply vendor-released patch commit 45758e4ec22451ab944ae2ae826b1e70f6450dc9 available from the InnoShop GitHub repository at https://github.com/innocommerce/innoshop/commit/45758e4ec22451ab944ae2ae826b1e70f6450dc9. The patch adds a has_install_lock() verification check that prevents installation functionality from registering when installation is complete. For environments unable to immediately patch, implement compensating controls by blocking HTTP access to installation endpoints via web server configuration (deny access to /install routes or equivalent paths), or physically remove the innopacks/install directory from production deployments after initial setup is verified complete. Note that removing installation files prevents future reinstallation without redeploying code, so maintain proper backups. Verify installation lock file exists and has appropriate permissions to prevent unauthorized modification. Review web server access logs for unauthorized attempts to access installation endpoints prior to remediation.