CVE-2026-71531
Gravedad CVSS v4.0:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
13/11/2026
Última modificación:
13/11/2026
Descripción
*** Pendiente de traducción *** PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key restricted to one shop to act on data of every shop by submitting requests with id_shop=all or id_shop_group=N, which expand the shop context without validating the key's actual shop associations and cause shopHasRight() to evaluate the expanded set as a disjunction. Attackers can exploit this flaw via classes/webservice/WebserviceRequest.php to read, modify, or delete data belonging to shops they are not authorized for, including full customer records such as email addresses, secure_key, and password hashes across the installation.
Impacto
Puntuación base 4.0
8.60
Gravedad 4.0
ALTA
Puntuación base 3.x
8.10
Gravedad 3.x
ALTA
Referencias a soluciones, herramientas e información
- https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.9
- https://github.com/PrestaShop/PrestaShop/releases/tag/9.2.1
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3f36-4qv4-vfgh
- https://www.vulncheck.com/advisories/prestashop-webservice-api-authorization-bypass-via-id-shop-parameter