CVE-2026-72843

Received Received - Intake

Unauthenticated Account Takeover in EverShop via Customer Update

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to that record, hashing a password if one is provided, without verifying that the caller owns the record. An unauthenticated request carrying a known customer uuid can therefore overwrite that customer's email address and password and read back the updated record from the 200 response, taking over the account and locking out its owner. Customer uuids are exposed through order confirmation email links and administrative URLs. Version 2.2.1 changes the route to "access": "private".

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-72843

EUVD

EUVD-2026-63730

Affected Vendors & Products

Vendor	Product	Version / Range
evershop	evershop	2.2.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in EverShop allows an unauthenticated attacker to take over customer accounts by exploiting a misconfigured route. The customer update route is set to public access, bypassing admin authentication. An attacker can send a request with a known customer UUID to overwrite email, password, and other details without ownership verification. The attacker can then lock out the legitimate user and gain full control of the account.

Detection Guidance

Check EverShop admin routes for the customer update endpoint with public access. Inspect route.json files in packages/evershop/src/modules/customer/api/updateCustomer/. Verify if the route lacks authentication middleware and customer-session guards.

Impact Analysis

If you are an EverShop user, this vulnerability could allow attackers to hijack your customer account, change your email or password, and lock you out. Attackers can access sensitive data, make unauthorized purchases, or impersonate you. Since customer UUIDs are exposed in order confirmations and admin URLs, the risk is higher if you have interacted with an EverShop store.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and potential data breaches. It may also breach HIPAA if customer health data is exposed or modified. Compliance requires protecting customer data integrity and access controls, which this flaw undermines by allowing unauthorized account takeover.

Mitigation Strategies

Upgrade to EverShop version 2.2.1 or later where the route access is set to private. If upgrading is not possible, manually change the access field in route.json from public to private and implement authentication checks in the updateCustomer.js handler.

Hi! I’m here to help you understand CVE-2026-72843. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70