CVE-2025-12919: EverShop Unauthorized Order Information Access Vulnerability
Summary
CVE-2025-12919: EverShop is vulnerable to Unauthorized Order Information Access (IDOR). Affects @evershop/evershop versions < 2.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
EverShop is an open-source e-commerce platform designed to facilitate online sales and manage orders efficiently. It provides features such as product management, order processing, and customer relationship management. However, versions up to 2.0.1 are vulnerable to an unauthorized access issue, which can lead to sensitive order information being exposed.
Vulnerability Detail
A vulnerability has been identified in EverShop, specifically in the Order Handler component located in the file /src/modules/oms/graphql/types/Order/Order.resolvers.js. The issue arises from improper control of resource identifiers due to manipulation of the 'uuid' argument. This vulnerability allows attackers to access order information that they should not have permission to view. The attack can be executed remotely and is characterized by high complexity, making it difficult to exploit. The vulnerability has been publicly disclosed, and the vendor has not responded to initial reports.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement additional access controls in your application to restrict access to order information based on user roles. This may involve modifying the GraphQL resolvers to check user permissions before returning order data.
Conclusion
The CVE-2025-12919 vulnerability in EverShop poses a risk of unauthorized access to sensitive order information. It is crucial for users of affected versions to update to the latest version to mitigate this risk. Implementing temporary access controls can also help protect against potential exploitation until an update can be applied.
See every vulnerability recorded for @evershop/evershop →
FAQ
CVE-2025-12919 is a vulnerability in EverShop that allows unauthorized access to order information due to improper handling of resource identifiers.
Versions of EverShop up to 2.0.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package right away, consider implementing additional access controls as a temporary workaround to protect sensitive order information.
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for @evershop/evershop.
