EverShop Customer Account Takeover

EverShop's customer update route is publicly accessible, allowing unauthenticated users to change email addresses and passwords of other customers.

EverShop versions prior to 2.2.1 are affected. An attacker can exploit this to take over customer accounts.