CVE-2026-57760: Missing Authorization in Sendcloud Shipping Access Controls

Technical summary

CVE-2026-57760 is a Missing Authorization vulnerability (CWE-862) in Sendcloud Shipping affecting versions through 1.0.29. The flaw stems from incorrectly configured access control security levels that fail to enforce proper authorization checks. The CVSS 3.1 score of 5.3 (MEDIUM) reflects a network-accessible attack vector requiring no privileges or user interaction, with integrity impact but no confidentiality or availability loss. The absence of authentication requirements means the vulnerability can be exploited by remote unauthenticated actors.

Business impact

A successful exploitation could allow attackers to modify shipping access controls, potentially disrupting order fulfillment workflows, altering shipping permissions for users, or creating privilege escalation paths within the platform. Organizations relying on Sendcloud Shipping for order management face risk of unauthorized configuration changes that could go undetected until discovered through audit or operational anomalies. The integrity impact could compromise the trustworthiness of shipping permissions and audit trails.

Affected systems

Sendcloud Shipping versions from an unspecified baseline through version 1.0.29 are vulnerable. Organizations using any version up to and including 1.0.29 should prioritize assessment. Verify your installed version in the Sendcloud admin panel or deployment logs to confirm exposure.

Exploitability

The vulnerability is relatively straightforward to exploit due to the absence of authentication barriers. No privileges, special network position, or user interaction is required—an attacker with network access can attempt to modify access control settings directly. However, the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been formally documented at this time.

Remediation

Upgrade Sendcloud Shipping to a version that addresses the missing authorization controls. Contact Sendcloud support or consult their security advisories to identify the patched version. Until a patch is deployed, restrict network access to Sendcloud Shipping instances to trusted networks, disable remote administrative interfaces if not required, and enforce strict network segmentation around your shipping infrastructure.

Patch guidance

Sendcloud should have released a security update addressing CWE-862. Verify the availability of patched versions by consulting the official Sendcloud security advisory or release notes. Apply patches in a controlled manner—test in a non-production environment first to ensure compatibility with your order management workflows. Prioritize patching if you expose Sendcloud Shipping to untrusted networks or the broader internet.

Detection guidance

Monitor Sendcloud Shipping access control logs for unauthorized modifications to permission settings, user role assignments, or administrative configurations. Look for API calls or administrative actions originating from unexpected IP addresses or without corresponding user login sessions. Alert on any changes to authorization levels that do not correlate with legitimate administrative activity. Network IDS/IPS signatures may detect unusual access patterns to Sendcloud administrative endpoints if the attacker probes access control boundaries.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), the absence of authentication requirements and the direct integrity impact on access controls warrant prompt attention. Shipping and fulfillment operations are often critical to revenue, and unauthorized access control changes could silently compromise operational trust. However, the lack of KEV designation and absence of confidentiality or availability impact place this below critical business-risk vulnerabilities. Prioritize patching for internet-facing Sendcloud instances and those handling high-value orders.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects: Network-accessible attack surface (AV:N), low attack complexity (AC:L), no privilege or authentication requirement (PR:N/UI:N), single security domain scope (S:U), no confidentiality loss (C:N), integrity impact (I:L), and no availability loss (A:N). This is a moderate risk that should not be neglected but ranks below vulnerabilities affecting confidentiality, availability, or requiring authentication bypass to critical systems.

Frequently asked questions