---
id: CVE-2026-115323
title: EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API
summary: >-
  EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in
  the customer address API that allows unauthenticated attackers to manage other
  customers' addresses. Attackers who know customer and address UUIDs can send
  POS…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-862
vendor: evershopcommerce
product: evershop
affected:
  - evershop >= 1.2.2 < 2.2.1
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T10:57:42.424Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115323'
references:
  - url: 'https://github.com/evershopcommerce/evershop/issues/928'
  - url: >-
      https://github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941f7
  - url: 'https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1'
    label: v2.2.1 Release Notes
  - url: >-
      https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomerAddress/updateCustomerAddress.js
  - url: >-
      https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/deleteCustomerAddress/route.json
  - url: 'https://github.com/evershopcommerce/evershop'
  - url: >-
      https://www.vulncheck.com/advisories/evershop-1.2.2-before-2.2.1-missing-authorization-via-customer-address-api
    label: >-
      VulnCheck Advisory: EverShop 1.2.2 before 2.2.1 Missing Authorization via
      Customer Address API
tags:
  - cve.org
ingestedAt: '2026-10-22T11:37:02.337Z'
---

## Overview

EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.

## Affected

- `evershop >= 1.2.2 < 2.2.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.