PT-2025-36611 · Packagist · Prestashop/Prestashop

Published 2025-09-04 · Updated 2025-09-04

OSV

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Impact

An unauthenticated attacker with access to the back-office URL can manipulate the id employee and reset token parameters to enumerate valid back-office employee email addresses.

Impacted parties: Store administrators and employees: their email addresses are exposed. Merchants: risk of phishing, social engineering, and brute-force attacks targeting admin accounts.

Patches

PrestaShop 8.2.3

Workarounds

You must upgrade, or at least apply the changes from the PrestaShop 8.2.3 patch. More information: https://build.prestashop-project.org/news/2025/prestashop-8-2-3-security-release/

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-359

Related Identifiers

GHSA-8XX5-H6M3-JR33

Affected Products

Prestashop/Prestashop

References · 10

• https://osv.dev/vulnerability/GHSA-8xx5-h6m3-jr33 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-51586 · Security Note
• https://github.com/PrestaShop/PrestaShop · Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.3 · Note
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-8xx5-h6m3-jr33 · Note
• https://github.com/PrestaShop/PrestaShop/commit/c97bdf10f77fedbe5a61a1dec5f96b3abb1d76fb · Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.1 · Note
• https://prestashop.com · Note
• https://maxime-morel.github.io/advisories/2025/CVE-2025-51586.md · Note
• https://build.prestashop-project.org/news/2025/prestashop-8-2-3-security-release · Note