CVE-2026-112071 Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-112071?
CVE-2026-112071 is a medium-severity vulnerability in Extension "TYPO3 Shop by coding.ms", published on 20 Oct 2026.
Official description
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
Weakness: CWE-862
Which versions are affected by CVE-2026-112071?
How do I fix CVE-2026-112071?
No fix has been published for CVE-2026-112071 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-112071 being exploited?
There is no known exploitation of CVE-2026-112071 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-xgm2-8h2x-9cj6.