Is CVE-2026-110771 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110771?

CVE-2026-110771 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-110771

Description

Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publish reviews and ratings attributed to other store customers, corrupting authorship and product ratings.