CVE-2026-72843

creationtimestamp| type| source ---|---|--- 2026-08-20 23:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtkdymxlgh27 2026-08-21 00:11:39+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtkhxja3xh23 2026-08-21 00:40:05+00:00| seen|...

CVE-2026-72843

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...

@pakasa/duuka-airtel-money-pay (>=0.0.12, <=0.0.16), @pakasa/duuka-checkout (>=0.0.1, <=0.0.9) +9 more potentially affected by CVE-2026-72843 via @evershop/evershop (>=1.0.0-rc.5, <=1.2.2)

@evershop/evershop NPM version =1.0.0-rc.5, =0.0.12, =0.0.1, =0.0.5, =0.0.1, =1.0.0, =0.0.2, =0.0.2, =0.0.4, =0.1.2, =1.1.0 Source cves: CVE-2026-72843 Source advisory: MEND:CVE-2026-72843...