CVE-2026-71519

PrestaShop versions before 8.2.9 and 9.2.1 are vulnerable to a broken access control vulnerability in a multi-shop installation. An authenticated Webservice API key holder can bypass record-level shop ownership checks within the shopHasRight() and saveEntityFromXml() functions. This allows the at...