CVE-2026-71531

Description

PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key restricted to one shop to act on data of every shop by submitting requests with id_shop=all or id_shop_group=N, which expand the shop context without validating the key's actual shop associations and cause shopHasRight() to evaluate the expanded set as a disjunction. Attackers can exploit this flaw via classes/webservice/WebserviceRequest.php to read, modify, or delete data belonging to shops they are not authorized for, including full customer records such as email addresses, secure_key, and password hashes across the installation.

References

• https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.9
• https://github.com/PrestaShop/PrestaShop/releases/tag/9.2.1
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3f36-4qv4-vfgh
• https://www.vulncheck.com/advisories/prestashop-webservice-api-authorization-bypass-via-id-shop-parameter