CVE-2026-113468
Deferred Deferred - Pending Action

PayPal Payment Notification Manipulation Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: TYPO3

Description
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-113468
EUVD
EUVD-2026-104865

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows any visitor to a website to manipulate payment notifications for orders that have not yet been paid. The payment notification endpoint does not verify if the data comes from the actual payment provider, enabling unauthorized changes to stored payment details.

Detection Guidance

This vulnerability can be detected by checking if your TYPO3 Shop extension is outdated. Inspect the extension version in the TYPO3 backend or via file system checks. Compare installed versions against the patched versions (4.9.4, 5.21.1, 6.3.0).

Commands to check version: grep 'version' typo3conf/ext/shop/ext_emconf.php or use TYPO3 Install Tool. Monitor order status changes for unpaid orders without user interaction as a potential sign of exploitation.

Impact Analysis

If you run a website using the affected TYPO3 Shop extension, attackers could alter payment notifications to show incorrect payment statuses. This could lead to unpaid orders being marked as paid, causing financial losses or disputes.

Compliance Impact

This vulnerability allows unauthorized modification of payment data for unpaid orders, which could lead to incorrect financial records. This may impact compliance with GDPR by potentially exposing personal payment data to unauthorized changes and HIPAA by compromising financial transaction integrity.

Mitigation Strategies

Disable the payment notification endpoint in the TYPO3 Shop extension until a patch is applied. Review order data for unauthorized modifications and ensure only verified payment providers can update payment status.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113468. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...