CVE-2023-46942: High Missing Auth in EverShop GraphQL

CVE-2023-46942 is a high severity authentication flaw in the @evershop/evershop npm package, scored 7.5. Some GraphQL endpoints answer without proper authorization, so a remote attacker can read sensitive information. The advisory says versions before 1.0.0-rc.8 are affected, so upgrade to 1.0.0-rc.8 or later and review what the API exposes.

What's affected

The record and the Checkmarx advisory both say @evershop/evershop before version 1.0.0-rc.8 is affected. The GraphQL endpoints lack authentication, which lets remote attackers obtain sensitive information.

There is a small difference between sources. The CPE entries in the NVD record list only the 1.0.0 beta, beta1 and beta2 builds, while the description and advisory text say everything before 1.0.0-rc.8. Use the wider statement and treat any release earlier than rc.8 as affected.

The fixed version is 1.0.0-rc.8 or later. The project's GitHub releases show a later 1.0.0-rc.9 published on 22 December 2023, so most installs can simply move to the newest release candidate or stable version available to them.

The NVD record was published on 2024-01-13, scores 7.5 (High), and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Weakness class: CWE-287.

How to check if you're exposed

Find which version your project resolves, including copies pulled in by other packages.

npm ls @evershop/evershop
npm view @evershop/evershop version
grep -n "evershop" package.json package-lock.json

If you run EverShop from a deployed container, read the package version inside the image rather than trusting a tag name. Then review which GraphQL queries your storefront exposes to anonymous visitors, since that is the data this flaw reaches.

What to do now

1. Run npm ls to find every place @evershop/evershop is installed.
2. Upgrade to 1.0.0-rc.8 or later, then rebuild and redeploy your images.
3. Review access logs for unusual GraphQL queries from unknown clients over the period you ran an old version.
4. Check what customer and order data the GraphQL schema returns, and make sure admin queries require a session.
5. Add the package to dependency monitoring so the next advisory reaches you quickly.

Why it matters

GraphQL puts many data operations behind one endpoint, so one missing authorization check can expose a lot. The weakness is CWE-287, improper authentication. Here the endpoints did not require the caller to prove who they were before returning data.

The impact in the record is confidentiality only, with no change to data or availability. For a shop, the data at risk is customer and order information. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.

A flaw in an npm dependency also spreads through your supply chain, which makes an inventory the first useful step.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Checkmarx advisory for CVE-2023-46942 (DevHub)

Last reviewed: 19 October 2026.