CVE-2026-108696: CoreShop Authorization Bypass Vulnerability

CVE-2026-108696 Overview

CVE-2026-108696 is an authorization bypass vulnerability affecting CoreShop through version 1.5.5. The flaw resides in the OrderController and allows authenticated customers to perform actions on orders belonging to other customers. By supplying user-controlled identifiers, an attacker can confirm receipt of another user's order through the OrderConfirm endpoint or overwrite return tracking details through the SendReship endpoint. The vulnerability maps to CWE-639: Authorization Bypass Through User-Controlled Key, a classic Insecure Direct Object Reference (IDOR) pattern.

Critical Impact

Authenticated customers can tamper with other customers' orders, confirm deliveries they never received, and overwrite return shipment tracking data without authorization.

Affected Products

• CoreShop (CoreCms.Net) through 1.5.5
• CoreCms.Net.Web.WebApi component (OrderController)
• CoreCms.Net.Services component (CoreCmsOrderServices)

Discovery Timeline

• 2026-10-11 - CVE-2026-108696 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-108696

Vulnerability Analysis

The vulnerability affects two endpoints in OrderController: OrderConfirm and SendReship. Both endpoints accept identifiers from the request body without validating that the requesting user owns the referenced order. CoreShop issues authentication tokens for customer accounts, but the business logic layer never cross-checks the resolved order against the authenticated session.

An attacker with any valid customer account can enumerate or guess order identifiers. The attacker can then invoke OrderConfirm to mark another customer's order as received, which typically releases funds to the seller and closes refund windows. Through SendReship, the attacker can overwrite return tracking metadata on arbitrary return records, disrupting legitimate refund workflows.

Root Cause

The root cause is missing object-level authorization in the controller methods. The server trusts the data field (order id) in OrderConfirm and the reshipId field in SendReship as supplied by the client. When data is omitted in OrderConfirm, the handler falls back to a code path that does not re-bind the record to the current user. The service layer in CoreCmsOrderServices performs the state mutation without comparing the order's userId to the caller's identity.

Attack Vector

Exploitation requires only a low-privilege authenticated customer session on the storefront. The attacker crafts an HTTP POST request to the vulnerable endpoints, substitutes a target orderId or reshipId, and submits it. No user interaction from the victim is required. The attack is network-reachable and does not require elevated privileges beyond a standard registered account. See the VulnCheck Advisory for CoreShop and the referenced OrderController source lines for the specific handler logic.

No public proof-of-concept exploit code is listed in the advisory. Technical details are discussed in the HackMD Security Discussion.

Detection Methods for CVE-2026-108696

Indicators of Compromise

• Repeated POST requests to /api/Order/OrderConfirm with sequential or non-owned order identifiers
• POST requests to /api/Order/SendReship where the authenticated user id does not match the owner of reshipId
• Order state transitions to "confirmed received" without a corresponding logistics delivery event
• Return tracking numbers overwritten shortly after creation by a different user session

Detection Strategies

• Correlate OrderConfirm and SendReship API calls against the authenticated session's owned-order list and alert on mismatches
• Enable WAF or reverse-proxy logging that captures request bodies for the two endpoints and apply anomaly detection on orderId/reshipId enumeration patterns
• Review database audit trails for order status updates and return-tracking edits that lack a matching user-owned transaction record

Monitoring Recommendations

• Baseline the normal rate of OrderConfirm calls per customer account and alert on accounts exceeding that baseline
• Monitor for a single customer account referencing many distinct orderId values within a short time window
• Track customer complaints about auto-confirmed orders or altered return shipments and pivot into web logs for the responsible session

How to Mitigate CVE-2026-108696

Immediate Actions Required

• Inventory all CoreShop deployments and identify instances running 1.5.5 or earlier
• Restrict access to the /api/Order/OrderConfirm and /api/Order/SendReship endpoints at the WAF or API gateway until patched
• Enforce server-side ownership checks by adding a filter that validates the authenticated userId against the target order's userId before any state mutation
• Rotate customer session tokens if abuse is suspected and review order history for unauthorized state transitions

Patch Information

As of the NVD publication date, the CoreShop GitHub Repository does not list an official fixed release addressing CVE-2026-108696. Operators should track the upstream repository for a security release and apply the patch when available. In the interim, apply the code-level ownership checks described in the workarounds below.

Workarounds

• Modify OrderController.OrderConfirm to reject requests where data is empty, and resolve the order strictly from a user-scoped query
• Modify OrderController.SendReship to look up the reshipId only within records owned by the authenticated user, returning HTTP 403 otherwise
• Add a server-side authorization filter attribute to all order mutation endpoints that enforces an owner check against the JWT claims
• Enable per-account rate limiting on order and reship endpoints to blunt enumeration attempts

# Example reverse-proxy rule to block anonymous or malformed OrderConfirm bodies
# (nginx snippet - adapt to your deployment)
location /api/Order/OrderConfirm {
    if ($request_method = POST) {
        if ($http_authorization = "") { return 401; }
    }
    client_max_body_size 8k;
    proxy_pass http://coreshop_backend;
}