CVE-2026-108696CWE-639

CVE-2026-108696

Medium · published October 11, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
12.0
In the wild
Unconfirmed
What it is

CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm receipt of others' orders and overwrite return tracking details.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00222 · 12.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-10-11T06:16Z
References (6)
https://github.com/CoreUnion/CoreShop · [email protected]https://github.com/CoreUnion/CoreShop/blob/ca7408b025bc5f3fd5957a79618ffe991c4e91ab/CoreCms.Net.Services/Order/CoreCmsOrderServices.cs#L2048-L2060 · [email protected]https://github.com/CoreUnion/CoreShop/blob/ca7408b025bc5f3fd5957a79618ffe991c4e91ab/CoreCms.Net.Web.WebApi/Controllers/OrderController.cs#L281-L294 · [email protected]https://github.com/CoreUnion/CoreShop/blob/ca7408b025bc5f3fd5957a79618ffe991c4e91ab/CoreCms.Net.Web.WebApi/Controllers/OrderController.cs#L422-L458 · [email protected]https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SkVjopPsGe · [email protected]https://www.vulncheck.com/advisories/coreshop-through-1.5.5-authorization-bypass-via-ordercontroller-orderconfirm-and-sendreship · [email protected]
EPSS history
Timeline
  • 12 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 11 OCT 01:35Z
    CoreShop through 1.5.5 Authorization Bypass via OrderController OrderConfirm and SendReship
    cvelistv5
  • 11 OCT 01:35Z
    CoreShop through 1.5.5 Authorization Bypass via OrderController OrderConfirm and SendReship
    cvelistv5