An update route for customers was incorrectly exposed as public, bypassing authentication checks. The route allows any caller to send a PATCH request with a user ID in the URL and arbitrary fields, causing the system to write the supplied data to the target customer's record. An attacker who knows a customer’s UUID can overwrite that user’s email address and password, gaining full account control and potentially locking out the legitimate owner.

All releases of EverShop prior to version 2.2.1 are vulnerable. The fix in 2.2.1 changes the route to private, preventing unauthenticated access.

With a CVSS score of 9.3 the vulnerability is considered critical. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog. The attack is derived from the public PATCH endpoint; an unauthenticated client can exploit the flaw by sending a crafted request with a known UUID, a path inferred from order confirmation emails or administrative URLs. Once exploited, the attacker can modify account credentials and read the 200 response containing the updated data.