CVE-2026-72843

creationtimestamp| type| source ---|---|--- 2026-08-20 23:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtkdymxlgh27 2026-08-21 00:11:39+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtkhxja3xh23 2026-08-21 00:40:05+00:00| seen|...

CVE-2026-72843

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...