EverShop versions before 2.2.1 contain a missing authorization flaw (CWE-862) in the customer address API. This flaw lets an unauthenticated attacker, given knowledge of a customer’s UUID and an address UUID, issue POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses. The attacker can create, modify, or delete the target customer’s saved shipping addresses, potentially enabling fraud or disrupting legitimate shipments.

The affected vendor is EverShopCommerce, product EverShop. The vulnerability exists in all releases from 1.2.2 up to, but not including, 2.2.1. Only those versions that expose the customer address endpoints without an authorization check are impacted.

The CVSS score of 6.9 places this vulnerability in the Medium severity range. No EPSS score is available, and it is not listed in CISA’s KEV catalog, indicating limited publicly known exploitation. The attack requires knowing valid customer and address UUIDs, which can be discovered through enumeration or social engineering. An attacker who gains access can alter shipping data, causing potential financial loss or service disruption. The absence of a required authentication step makes the exploit straightforward for anyone able to guess or obtain the identifiers.