AIKIDO-2026-702652

aimeos/aimeos-core is vulnerable to Mass Assignment

Mass Assignment Pre-CVE Published Yesterday

Medium Risk

This Affects:

aimeos/aimeos-core

2019.10.1 - 2022.10.21

Fixed in 2022.10.22

2023.04.1 - 2023.10.28

Fixed in 2023.10.29

2024.04.1 - 2024.10.18

Fixed in 2024.10.19

2025.04.1 - 2025.10.7

Fixed in 2025.10.8

2026.04.1 - 2026.04.4

Fixed in 2026.04.5

Are you affected? Scan for Free

TL;DR

The Xml delivery service provider's order import applies every field from an incoming ERP status XML node directly onto the matched order item with no restriction on which fields can be set. A delivery or ERP system response can overwrite order fields beyond its intended payment and delivery status and date updates. The patch restricts the import to only the payment status, delivery status, and their date fields before the values are applied to the order.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use the Xml delivery service provider to receive order status updates from an external ERP system.

Background info

aimeos/aimeos-core is vulnerable to Mass Assignment in versions 2019.10.1 - 2022.10.21, 2023.04.1 - 2023.10.28, 2024.04.1 - 2024.10.18, 2025.04.1 - 2025.10.7 and 2026.04.1 - 2026.04.4.