Evershop Unauthorized Order Information Access (IDOR) Security Advisory CVE ID: CVE-2025-12919 Product: EverShop E-Commerce Platform Vulnerability Type: Insecure Direct Object Reference (IDOR) Severity: HIGH CVSS v3.1 Score: 7.5 CWE: CWE-639 (Authorization Bypass Through User-Controlled Key) Disclosure Date: 2025-10-23 UTC Executive Summary A critical authorization vulnerability has been identified in EverShop's GraphQL API that allows any unauthenticated user to access complete order information, including customer personally identifiable information (PII), shipping addresses, billing details, and purchase history. This is a textbook Insecure Direct Object Reference (IDOR) vulnerability where the application fails to verify whether the requesting user has permission to access the requested order data. Vulnerability Details The GraphQL query resolver accepts an order UUID as input and returns complete order details without performing any authentication or authorization checks. An attacker who obtains or guesses a valid order UUID can retrieve sensitive customer information. Affected Components - File: (lines 7-14) Attack Vector Prerequisites - Authentication: None required - Access Level: Public (unauthenticated users) - Complexity: Low - User Interaction: None Remediation 1. Apply Emergency Patch 2. Alternative: Token-Based Access