CVE-2026-7630: InnoShop Authentication Bypass Vulnerability

CVE-2026-7630 Overview

CVE-2026-7630 is an improper authentication vulnerability [CWE-287] affecting innocommerce InnoShop versions up to and including 0.7.8. The flaw resides in the InstallServiceProvider::boot function within innopacks/install/src/InstallServiceProvider.php, which exposes the installation endpoint without verifying whether the application is already installed. Remote attackers can reach the install routes over the network without authentication and trigger an application reinstall takeover. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed InnoShop deployments. A patch is available in commit 45758e4ec22451ab944ae2ae826b1e70f6450dc9.

Critical Impact

Unauthenticated remote attackers can reach the InnoShop installation endpoint on already-deployed instances and reinitialize the application, potentially seizing administrative control of the storefront.

Affected Products

• innocommerce InnoShop versions up to 0.7.8
• Component: Installation Endpoint (innopacks/install/src/InstallServiceProvider.php)
• Affected function: InstallServiceProvider::boot

Discovery Timeline

• 2026-05-02 - CVE-2026-7630 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7630

Vulnerability Analysis

The vulnerability is an improper authentication issue in the InnoShop installer service provider. During application bootstrap, InstallServiceProvider::boot unconditionally registered the install web routes and loaded translations, regardless of whether the application had already completed installation. This means production deployments of InnoShop continued to expose install routes after setup, and any unauthenticated network user could invoke them.

The attack falls under [CWE-287] Improper Authentication. By interacting with the install endpoint, an attacker can repeat the installation workflow on a live instance, overwriting configuration, database settings, and the administrator account. Successful exploitation results in pre-authentication takeover of the storefront.

Root Cause

The root cause is the absence of a state check in the service provider boot path. The fixed code introduces a has_install_lock() guard that returns early when an install lock file is present, ensuring install routes are not registered on already-installed instances. Without this guard, the installation routes remained reachable indefinitely.

Attack Vector

Exploitation requires only network access to the InnoShop web interface. No credentials, user interaction, or elevated privileges are needed. An attacker browses to the install endpoint and walks through the installer to reset application state and credentials.

// Patched InstallServiceProvider::boot - adds install lock check
     */
    public function boot(): void
    {
+       if (has_install_lock()) {
+           return;
+       }
+
        $this->registerWebRoutes();
        $this->loadTranslations();
    }

Source: GitHub Commit 45758e4 - the patch prevents pre-auth application reinstall takeover by short-circuiting the boot method when an install lock exists.

Detection Methods for CVE-2026-7630

Indicators of Compromise

• Unexpected HTTP requests to install paths such as /install, /install/setup, or related routes registered by InstallServiceProvider after initial deployment.
• Modifications to the application .env file or database configuration outside of change windows.
• Creation of new administrator accounts or password resets on the InnoShop admin user immediately following install endpoint traffic.
• Absence or removal of the InnoShop install lock file on production instances.

Detection Strategies

• Monitor web access logs for any HTTP traffic targeting /install URI patterns on production InnoShop hosts.
• Alert on file integrity changes to innopacks/install/src/InstallServiceProvider.php, .env, and the install lock artifact.
• Correlate install endpoint requests with subsequent administrative login attempts from the same source address.

Monitoring Recommendations

• Enable verbose web server and application logging for the InnoShop install routes and forward logs to a centralized analytics platform.
• Track outbound database connection string changes and admin user mutations as high-priority events.
• Periodically scan internet-exposed InnoShop deployments for reachable install endpoints using authenticated configuration audits.

How to Mitigate CVE-2026-7630

Immediate Actions Required

• Upgrade InnoShop to the version containing commit 45758e4ec22451ab944ae2ae826b1e70f6450dc9 or later.
• Restrict network access to the InnoShop application until the patch is applied, using firewall or reverse proxy rules.
• Verify the presence of an install lock file and confirm has_install_lock() returns true on production deployments.
• Audit administrator accounts and reset credentials if install endpoint access is observed in logs.

Patch Information

The upstream fix is available in the InnoShop repository as commit 45758e4ec22451ab944ae2ae826b1e70f6450dc9. Pull the latest InnoShop release that includes this commit, redeploy the application, and clear cached service providers. Reference materials: InnoShop GitHub Repository, Patch Commit, and Issue #314 Discussion.

Workarounds

• Block all external requests to /install* URIs at the reverse proxy or web application firewall layer.
• Remove or disable the InstallServiceProvider registration in config/app.php after installation completes.
• Ensure the install lock file exists on disk so any future patched code path correctly short-circuits route registration.

# Example nginx rule to block install endpoint exposure on production
location ~* ^/install(/|$) {
    deny all;
    return 403;
}