Missing Authorization in TYPO3 Shop by coding.ms - CVE-2026-112071
Published: October 21, 2026
Vulnerability identifier: #VU156654
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-112071
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to the order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. A remote attacker can set orders that are still awaiting payment to "canceled".
Affected software
TYPO3 Shop by coding.ms
How to mitigate CVE-2026-112071
Install updates from vendor's website.
TYPO3 Shop by coding.ms - addressed in versions 4.9.4, 5.21.1, 6.3.0