CVE-2022-33077

nopCommerce 4.50.2 has a broken-access-control flaw: the addressedit endpoint doesn't properly check ownership, so an attacker can modify any customer's address, not just their own. This is a classic insecure-direct-object-reference — the endpoint trusts an identifier without verifying the requester owns the target record — and in an e-commerce platform it means one authenticated customer can tamper with other customers' stored address data.

The impact is scoped to integrity of customer address records, which is meaningful but bounded: no code execution, no bulk data dump, no account takeover on its own. The realistic abuse is a logged-in user manipulating others' shipping details, which could enable fraud (redirecting orders) or be a nuisance/data-integrity problem at scale. It's authenticated and single-record-at-a-time, which is why it sits at high-but-not-critical; the value to an attacker depends on how order fulfillment trusts that address data downstream.

Our angle is to weigh the downstream fraud potential and the platform's exposure. Where nopCommerce 4.50.2 runs a live storefront, we'd prioritize by whether address changes feed directly into shipping or payment flows that an attacker could redirect, and drive the update to a fixed release. IDOR bugs also travel in packs, so finding one broken ownership check is a prompt to review sibling endpoints for the same missing authorization, and where we have request logging, to watch for one account editing addresses tied to other customer IDs as the abuse signature.