EverShop Vulnerability: Public Access to Customer Update Route
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- evershop (npm)
- Affected versions
- >= v1.2.1, <= v1.2.1 or >= v1.2.0, <= v1.2.0 or >= v1.1.0, <= v1.1.0 or >= v1.0.0, <= v1.0.0 or >= 1.0.0-rc.9, <= 1.0.0-rc.9
- Patched version
- 2.2.1
An early warning has been issued for a critical vulnerability in EverShop that allows unauthenticated users to overwrite customer email addresses and passwords. Users of affected versions should take immediate action.
What happened
An early warning has been issued for a critical vulnerability in EverShop, identified as CVE-2026-72843. The vulnerability is due to the customer update route being accessible publicly, which allows unauthenticated users to overwrite customer email addresses and passwords. This issue affects versions of EverShop from 1.0.0-rc.9 to 1.2.1. The vulnerability was first flagged on 2026-08-20T22:18:05.253000+00:00. There is no evidence that this vulnerability has been exploited in the wild.
The vulnerability arises because the customer update route in EverShop is declared with "access": "public" in the route configuration, causing the admin authentication middleware to bypass checks and allowing any unauthenticated request to overwrite customer data. This can lead to account takeover and lockout of legitimate users.
What to do about it
- Upgrade to EverShop version 2.2.1 or later to mitigate the risk.
- Ensure that your EverShop installation is not using any of the affected versions (1.0.0-rc.9 to 1.2.1).
- Monitor the NVD and other primary sources for updates on this vulnerability.
- Consider implementing additional security measures to protect customer data until the upgrade is completed.
How 0Day would have caught this
evershop is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using EverShop version 1.0.0-rc.9 or later up to and including version 1.2.1.
What should I do right now?
Upgrade to EverShop version 2.2.1 or later to mitigate the risk. Ensure that your installation is not using any of the affected versions.
Is there an official fix available?
Yes, the official fix is to upgrade to EverShop version 2.2.1 or later.
Where can I find more information about this vulnerability?
More information can be found on the NVD website at https://nvd.nist.gov/vuln/detail/CVE-2026-72843.