Improper access control on the back-office notifications endpoint exposes customer data

Improper access control on the back-office notifications endpoint exposes customer data

Impact

This is a broken access control issue in the back office.

The data behind the notification panel in the back-office header was served without checking the employee's permissions. Any employee account, including one whose profile grants no permission at all could therefore read recent customer and order information: customer names, order totals, carrier and order status.

Shops that rely on restricted employee profiles to separate roles between staff, agencies or contractors are impacted. Exploitation requires a valid back-office session, so the shop front and anonymous visitors are not affected. The exposed data is personal, so the issue also carries a GDPR dimension for merchants.

Patches

The notification endpoints now require read permission on orders, customers or customer-service threads, and return a "forbidden" response otherwise.

Upgrade to PrestaShop 9.1.5 or PrestaShop 8.2.8

Workarounds

There is no configuration-level workaround: the endpoint is part of the standard back office and is called by every logged-in employee.

References

• CWE-862: Missing Authorization
• Report a security issue: security-core@prestashop.com

Credits: this vulnerability was responsibly reported to the PrestaShop security team by Robert Scherer. We thank them for their report and for coordinating the disclosure with us.