CVE-2026-28213

{"id": "CVE-2026-28213", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2026-02-26T23:16:35.770", "references": [{"url": "https://github.com/evershopcommerce/evershop/releases/tag/v2.1.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/evershopcommerce/evershop/security/advisories/GHSA-cg73-g723-39jw", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-640"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the \"Forgot Password\" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attacker to take over the associated account. Version 2.1.1 fixes the issue."}, {"lang": "es", "value": "EverShop es una plataforma de comercio electr\u00f3nico TypeScript-first. Versiones anteriores a la 2.1.1 tienen una vulnerabilidad en la funcionalidad de 'Olvid\u00e9 mi contrase\u00f1a'. Al especificar una direcci\u00f3n de correo electr\u00f3nico objetivo, la respuesta de la API devuelve el token de restablecimiento de contrase\u00f1a. Esto permite a un atacante tomar el control de la cuenta asociada. La versi\u00f3n 2.1.1 soluciona el problema."}], "lastModified": "2026-02-28T01:18:18.080", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:evershop:evershop:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "454D1A1C-4946-4C6C-A2D8-B07AEF27E3E2", "versionEndExcluding": "2.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}