evershop vulnerabilities
CVEs whose affected-version data names the evershop package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-115323High· 7.3EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POS…
▾ Twilightevershopcommerce · evershopEPSS 0.24%via CVEORG
CVE-2026-72843Critical· 9.8The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the calle…
The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the calle…
▾ Midnightevershopcommerce · evershopEPSS 0.84%via NVD