CVE-2026-23959: CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier

January 21, 2026 (updated January 22, 2026)

An error-based SQL Injection vulnerability was identified in the CustomerTransformerController within the CoreShop admin panel. The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction.

This issue is classified as MEDIUM severity, as it allows SQL execution in an authenticated admin context.

References

github.com/advisories/GHSA-fqcv-8859-86x2
github.com/coreshop/CoreShop
github.com/coreshop/CoreShop/commit/af80b8f5c7df5f02f44e9c5e0a4a564de274eec2
github.com/coreshop/CoreShop/releases/tag/4.1.9
github.com/coreshop/CoreShop/security/advisories/GHSA-fqcv-8859-86x2
nvd.nist.gov/vuln/detail/CVE-2026-23959

Code Behaviors & Features

Detect and mitigate CVE-2026-23959 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →