PT-2026-36620 · Innocommerce · Innoshop

Anch0R · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-7630

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions innocommerce InnoShop versions prior to 0.7.9

Description Improper authentication exists in the Installation Endpoint. The issue is located in the boot() function of the InstallServiceProvider class within the innopacks/install/src/InstallServiceProvider.php file. This flaw allows for remote exploitation.

Recommendations Apply the patch identified as 45758e4ec22451ab944ae2ae826b1e70f6450dc9 to resolve the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-7630

Affected Products

Innoshop

References · 9

• 🔥 https://github.com/innocommerce/innoshop/issues/314 · Exploit
• https://github.com/innocommerce/innoshop/commit/45758e4ec22451ab944ae2ae826b1e70f6450dc9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7630 · Security Note
• https://github.com/innocommerce/innoshop/issues/314#issuecomment-4357464458 · Note
• https://vuldb.com/vuln/360576/cti · Note
• https://vuldb.com/vuln/360576 · Note
• https://github.com/innocommerce/innoshop · Note
• https://vuldb.com/submit/806484 · Note
• https://twitter.com/VulmonFeeds/status/2050604602353971658 · Twitter Post