IDOR — Authenticated customers can forge GDPR consent records for arbitrary customers (psgdpr 1.4.3)

IDOR — Authenticated customers can forge GDPR consent records for arbitrary customers (psgdpr 1.4.3)

Impact

This is an Insecure Direct Object Reference (IDOR) in the consent logging of the psgdpr (Official GDPR Compliance) module.

When a customer gives consent through a form, the module records a "Consent confirmation" entry in its GDPR activity log. The customer the entry is attributed to was taken from the request instead of from the logged-in session, so a logged-in customer could create consent entries in the name of any other customer.

The forged entries show the other customer's name in the back-office GDPR activity log and cannot be told apart from genuine ones. The consent log can therefore no longer be relied on as evidence of who gave consent. No personal data is disclosed and no other customer data is modified.

A customer account on the shop is required.

Patches

Upgrade to psgdpr 1.4.4

Workarounds

None.

References

• CWE-639: Authorization Bypass Through User-Controlled Key
• CVE-2026-92809

Credits: this vulnerability was responsibly reported to the PrestaShop security team by @geo-chen and @boo-code . We thank them for their report.