cyfenced.com →

[ CVE-2026-110608 · Published 14 Oct 2026 ]

Vulnerability in BizSpring Shop

CVSS 5.4 EPSS <1%No fix listed yet

[ Description ]Official description

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can cancel victims' pending orders to release allocated stock or confirm receipt of shipped orders, advancing fulfilment and settlement without the victim's consent.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References