An authenticated customer can send requests to the OrderConfirm and SendReship endpoints with order or reship identifiers they do not own, and the application performs only minimal authorization checks. Attackers can omit the data field in OrderConfirm or supply an arbitrary reshipId to SendReship, allowing them to confirm receipt of other users’ orders or overwrite the return tracking details of orders that belong to different customers. The flaw is an access‑control weakness (CWE‑639).

CoreUnion:CoreShop releases up to version 1.5.5 (inclusive) are affected. All installations under this version family may allow malicious requesters to manipulate other customers’ orders.

The CVSS score of 5.3 classifies the risk as medium. EPSS data is unavailable, so exploitation likelihood cannot be precisely assessed, and this CVE is not listed in CISA's KEV catalog. An attacker must possess a valid authenticated session and can trigger the vulnerability by sending crafted HTTP requests to the OrderConfirm or SendReship endpoints, as described in the source code references. The likely attack vector is an authenticated web API request with user‑controlled identifiers.