---
id: CVE-2026-72843
title: >-
  The customer update route in EverShop is declared with "access": "public" in
  packages/evershop/src/modules/customer/api/updateCustomer/route.json, which
  causes the admin authentication middleware to call next() without checking the
  calle…
summary: >-
  The customer update route in EverShop is declared with "access": "public" in
  packages/evershop/src/modules/customer/api/updateCustomer/route.json, which
  causes the admin authentication middleware to call next() without checking the
  calle…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-862
vendor: evershopcommerce
product: evershop
affected:
  - evershop < 2.2.1
published: '2026-08-20'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72843'
references:
  - url: 'https://github.com/evershopcommerce/evershop'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomer/route.json
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomer/updateCustomer.js
    label: disclosure@vulncheck.com
  - url: 'https://github.com/evershopcommerce/evershop/issues/952'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/evershop-missing-authorization-on-patch-api-customers-id-allows-unauthenticated-account-takeover
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00837
epssPercentile: 0.5598
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-21T21:18:57.258144Z'
ingestedAt: '2026-09-24T15:45:56.713Z'
---

## Overview

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to that record, hashing a password if one is provided, without verifying that the caller owns the record. An unauthenticated request carrying a known customer uuid can therefore overwrite that customer's email address and password and read back the updated record from the 200 response, taking over the account and locking out its owner. Customer uuids are exposed through order confirmation email links and administrative URLs. Version 2.2.1 changes the route to "access": "private".

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.