SB2026102173 - Multiple vulnerabilities in TYPO3 Shop by coding.ms extension

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102173

SB2026102173 - Multiple vulnerabilities in TYPO3 Shop by coding.ms extension

Published: October 21, 2026

Security Bulletin ID SB2026102173
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Missing Authorization (CVE-ID: CVE-2026-112071)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to the order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. A remote attacker can set orders that are still awaiting payment to "canceled".


2) Missing Authorization (CVE-ID: CVE-2026-113468)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to the payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. A remote attacker can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content.


Remediation

Install update from vendor's website.

References