AIKIDO-2026-305891
@evershop/evershop is vulnerable to Missing Authorization
93
Critical Risk
This Affects:
@evershop/evershopTL;DR
The customer update route PATCH /api/customers/:id is declared with access set to public in route.json, so admin authentication middleware does not require a caller and no customer-session middleware guards the handler. updateCustomer.js loads the customer by the UUID from the URL and writes supplied fields, including a hashed password when provided, without verifying that the caller owns that record. An unauthenticated attacker who knows a customer UUID can overwrite that account's email and password and take it over. The fix marks the route as private.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@evershop/evershop is vulnerable to Missing Authorization in versions 0.1.0 - 2.1.2.
How to fix this
Upgrade the @evershop/evershop library to the patch version.
Links
GitHub Release
Related Issue
Other
github.com/evershopcommerce/evershopgithub.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomer/route.jsongithub.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomer/updateCustomer.js
vulncheck.com/advisories/evershop-missing-authorization-on-patch-api-customers-id-allows-unauthenticated-account-takeover
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant