CoreShop EUVD-2026-96699

Requires a valid authenticated CoreShop customer account (PR:L); any ordinary registered customer suffices, a low barrier on a public storefront. The attacker then invokes OrderController endpoints - OrderConfirm with the 'data' field omitted, or SendReship supplying another customer's reshipId - so the server acts on orders the attacker does not own. No special non-default configuration, elevated privileges, or user interaction is required, and the product is network-reachable (AV:N). Limiting factors: authentication is mandatory (purely unauthenticated attack is not possible), the attacker must know or enumerate valid order/reship ids belonging to victims, and impact is confined to integrity of order-confirmation and return-tracking data (no confidentiality disclosure or availability loss). Affected: CoreShop versions up to and including 1.5.5.

This is a genuine but moderate-severity authorization flaw (IDOR, CWE-639), not a high-CVSS-but-low-real-risk inflation case nor a critical emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N, score 5.3) is internally consistent with the description: network-reachable web API, low attack complexity, and crucially PR:L - exploitation requires an authenticated customer account, which caps impact. The only impact dimension is low integrity (VI:L): an attacker can confirm receipt of others' orders and overwrite their return tracking details, but there is no confidentiality (VC:N) or availability (VA:N) impact. No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input, so there is no signal of active exploitation; a detailed public technical writeup (hackmd) and direct source-code line references do exist, lowering the bar for an attacker to reproduce the issue. SSVC-style reasoning: exploitation status is 'none/public analysis available,' the flaw is likely automatable (simple authenticated API calls with manipulated ids), but technical impact is partial, not total. Net: real and worth patching for CoreShop operators, but the authentication requirement and integrity-only, business-logic impact keep it out of drop-everything territory.

An attacker registers or uses an ordinary customer account on a CoreShop (≤1.5.5) store, then calls the OrderController's OrderConfirm endpoint while omitting the data field, or calls SendReship supplying another customer's reshipId. Because the controller trusts user-controlled ids without verifying ownership, the attacker confirms receipt of a stranger's order or overwrites that order's return tracking details. A public technical writeup documents the exact endpoints and vulnerable code paths, making reproduction straightforward.