TYPO3-EXT-SA-2026-036: Broken Access Control in extension "shop" (shop)

• Release Date: October 20, 2026
• Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
• Component: "TYPO3 Shop by coding.ms" (shop)
• Composer Package Name: codingms/shop
• Vulnerability Type: Broken Access Control
• Affected Versions: 4.9.3 and below, 5.0.0 - 5.21.0, 6.0.0 - 6.2.0
• Severity: Medium
• Suggested CVSS v4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
• References: CVE-2026-112071, CVE-2026-113468, CWE-862

Problem Description

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". (CVE-2026-112071)

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. (CVE-2026-113468)

Both issues require a page that contains the shop's order plugin. Orders that are already paid are not affected.

Solution

Updated versions 4.9.4, 5.21.1, and 6.3.0 are available from the TYPO3 extension manager, packagist and at

https://extensions.typo3.org/extension/download/shop/4.9.4/zip
https://extensions.typo3.org/extension/download/shop/5.21.1/zip
https://extensions.typo3.org/extension/download/shop/6.3.0/zip

Users of the extension are advised to update the extension as soon as possible.

Credits

Thanks to Nguyen Le Thanh Nam for reporting the vulnerability and to Thomas Deuling for providing updated versions of the extension.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide.