CVE and update status of the FreeBSD ports tree3,924 unaddressed CVEs in 706 portsAll times are CET
CVE details

CVE-2026-71531

PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key restricted to one shop to act on data of every shop by submitting requests with id_shop=all or id_shop_group=N, which expand the shop context without validating the key's actual shop associations and cause shopHasRight() to evaluate the expanded set as a disjunction. Attackers can exploit this flaw via classes/webservice/WebserviceRequest.php to read, modify, or delete data belonging to shops they are not authorized for, including full customer records such as email addresses, secure_key, and password hashes across the installation.

Score
8.6 high
Published
2026-11-13
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
finance/prestashopprestashop8.2.5unaddressedwen@FreeBSD.org

Template for a VuXML entry

Check the content

Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>prestashop -- FIXME</topic>
    <affects>
      <package>
	<name>prestashop</name>
	<range><ge>8.2</ge><lt>8.2.9</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-71531: PrestaShop before 8.2.9 and 9.2.1 contains an
	  authorization flaw in the Webservice API that allows an attacker
	  holding a key restricted to one shop to act on data of every shop
	  by submitting requests with id_shop=all or id_shop_group=N, which
	  expand the shop context without validating the key's actual shop
	  associations and cause shopHasRight() to evaluate the expanded set
	  as a disjunction. Attackers can exploit this flaw via
	  classes/webservice/WebserviceRequest.php to read, modify, or delete
	  data belonging to shops they are not authorized for, including full
	  customer records such as email addresses, secure_key, and password
	  hashes across the installation.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-71531</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-71531</url>
    </references>
    <dates>
      <discovery>2026-11-13</discovery>
      <entry>2026-11-15</entry>
    </dates>
  </vuln>