Listen to this Post
How the CVE Works
This vulnerability is an Authenticated Insecure Direct Object Reference (IDOR) in the order update endpoint. The backend system correctly verifies a user’s authentication and authorization to modify their own order. However, it fails to perform a secondary, crucial authorization check. When a user submits a PATCH request to update their order’s billing address, they can include an address ID parameter. The server trusts this user-supplied address ID without validating ownership. It does not check if the referenced address object (id) actually belongs to the authenticated user making the request. Consequently, an attacker can replace a legitimate address ID with one belonging to another user. The server then processes this request, retrieves the foreign address from the database, and associates it with the attacker’s order. The response from the server includes the sensitive details of the other user’s address, leading to unauthorized information disclosure. The core flaw is a broken access control mechanism where object-level authorization is missing for referenced sub-resources within an authorized primary resource.
DailyCVE Form
Platform: Solidus E-commerce
Version: Undisclosed
Vulnerability: Authenticated IDOR
Severity: Medium-High
Date: 2026-01-09
Prediction: Undisclosed
What Undercode Say:
Analytics
`GET /account/addresses`
`POST /api/v2/storefront/cart`
`PATCH /api/v2/storefront/checkout {“include”:”billing_address”,”order”:{“bill_address_attributes”:{“id”:ATTACKER_ID}}}`
`PATCH /api/v2/storefront/checkout {“include”:”billing_address”,”order”:{“bill_address_attributes”:{“id”:VICTIM_ID}}}`
How Exploit:
1. Attacker authenticates as a legitimate user.
- They create or access an order to get a valid order token.
- They identify or guess the numeric ID of a target victim’s address.
- They send a manipulated PATCH request, replacing their address ID with the victim’s ID in the
bill_address_attributes. - The server responds, leaking the victim’s full address details within the order context.
Protection from this CVE
Implement object-level authorization. Add server-side checks verifying resource ownership. Validate all user-supplied object references. Use indirect reference maps (tokens). Apply uniform access control policies.
Impact:
Unauthorized data disclosure. Privacy violation (PII exposure). Potential for account compromise. Erosion of user trust.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
