CVE-2026-112071
Received Received - Intake

Unauthorized Order Cancellation in Shop Plugin

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: TYPO3

Description
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112071
EUVD
EUVD-2026-104866

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
TYPO3 Extension "TYPO3 Shop by coding.ms" 6.0.0
TYPO3 Extension "TYPO3 Shop by coding.ms" 5.0.0
TYPO3 Extension "TYPO3 Shop by coding.ms" 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Broken Access Control issue in the TYPO3 Shop extension. It allows any website visitor to cancel orders that are still awaiting payment by changing the order identifier in the request without verifying ownership. The shop plugin must be present on a page for this to be exploitable. Paid orders are not affected.

Detection Guidance

Check for unauthorized order cancellations in your shop system logs. Look for requests to the order plugin endpoint with manipulated order identifiers. Monitor for orders marked as canceled that were not paid.

Impact Analysis

This vulnerability could allow unauthorized users to cancel pending orders, potentially disrupting legitimate transactions and causing financial or operational issues for the shop owner. It may lead to loss of revenue or customer trust if exploited.

Mitigation Strategies

Update the TYPO3 Shop extension to versions 4.9.4, 5.21.1, or 6.3.0 immediately. Remove or restrict access to pages containing the vulnerable order plugin until patched. Review recent order status changes for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112071. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart