CVE-2026-110771

Deferred Deferred - Pending Action

Authorization Bypass in Shopizer Allows Review Spoofing

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110771

EUVD

EUVD-2026-101571

Affected Vendors & Products

Vendor	Product	Version / Range
Shopizer	Shopizer	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Shopizer through version 3.2.5 allows authenticated customers to manipulate the customerId field when submitting product reviews. By sending crafted requests to POST /api/v1/auth/products/{id}/reviews, attackers can post reviews and ratings under the identity of other customers. The flaw stems from improper authorization checks in the product review functionality.

Detection Guidance

To detect this vulnerability, monitor POST requests to /api/v1/auth/products/{id}/reviews. Check if the customerId in the request body matches the authenticated user. Unusual review activity or mismatched customer IDs may indicate exploitation. Review logs for repeated requests with varying customerId values.

Impact Analysis

This vulnerability allows attackers to forge, overwrite, or delete reviews attributed to other customers. It can corrupt product authorship and ratings, misleading other customers about product quality or authenticity. Attackers can also impersonate users when leaving reviews, potentially damaging trust in the platform.

Compliance Impact

This vulnerability could impact compliance with GDPR by enabling unauthorized data manipulation through forged reviews, potentially violating integrity and authenticity requirements under GDPR Article 5. It may also affect HIPAA if customer reviews contain protected health information, as unauthorized access or alteration could breach confidentiality rules.

Mitigation Strategies

Immediately update Shopizer to a patched version beyond 3.2.5. Implement server-side checks to validate that the customerId in review requests matches the authenticated user. Ensure review ownership is verified before allowing updates or deletions. Disable or restrict access to the vulnerable endpoints if patches are unavailable.

Hi! I’m here to help you understand CVE-2026-110771. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70