CVE-2026-28213

EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1	Product Release Notes
https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-39jw	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:evershop:evershop:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2026-02-26 23:16

Updated : 2026-02-28 01:18

NVD link : CVE-2026-28213

Mitre link : CVE-2026-28213

CVE.ORG link : CVE-2026-28213

JSON object : View

Products Affected

evershop

evershop

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2026-28213", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2026-02-26T23:16:35.770", "references": [{"url": "https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-39jw", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-640"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the \"Forgot Password\" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue."}, {"lang": "es", "value": "EverShop es una plataforma de comercio electr\u00f3nico TypeScript-first. Versiones anteriores a la 2.1.1 tienen una vulnerabilidad en la funcionalidad de 'Olvid\u00e9 mi contrase\u00f1a'. Al especificar una direcci\u00f3n de correo electr\u00f3nico objetivo, la respuesta de la API devuelve el token de restablecimiento de contrase\u00f1a. Esto permite a un atacante tomar el control de la cuenta asociada. La versi\u00f3n 2.1.1 soluciona el problema."}], "lastModified": "2026-02-28T01:18:18.080", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:evershop:evershop:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "454D1A1C-4946-4C6C-A2D8-B07AEF27E3E2", "versionEndExcluding": "2.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}