CVE-2026-86665

Deferred Deferred - Pending Action

Missing Authorization in iWebShop-5

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: VulDB

Description

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86665

Affected Vendors & Products

Vendor	Product	Version / Range
aircheng-org	iwebshop	to 5.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is in the aircheng-org iWebShop-5 software up to version 5.15. It exists in the Update::index function of the controllers/update.php file. The issue allows unauthorized access due to missing authorization checks. An attacker can remotely exploit this vulnerability, and a public exploit is available. The vendor was notified but has not responded.

Detection Guidance

Check if the vulnerable iWebShop-5 version (up to 5.15) is installed by inspecting the file controllers/update.php for the Update::index function. Look for unauthorized access attempts or unusual activity in web server logs targeting this file.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the system, potentially leading to data theft, modification, or disruption of services. Since the exploit is public, the risk of attack is higher. Systems running vulnerable versions of iWebShop-5 are at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately update iWebShop to the latest version if available. If no update exists, restrict access to the controllers/update.php file via web server configuration (e.g., Apache .htaccess or Nginx rules). Monitor network traffic for exploitation attempts and block suspicious IPs.

Hi! I’m here to help you understand CVE-2026-86665. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70