CVE-2026-117605: falha de média gravidade em nopSolutions nopCommerce
nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
nopSolutions · nopCommerceCVEs relacionadas — nopSolutions nopCommerce
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/nopSolutions/nopCommercehttps://github.com/nopSolutions/nopCommerce/blob/918444773367deb734b93d3ad80e17325d6c147a/src/Presentation/Nop.Web/Areas/Admin/Controllers/ProductController.cs#L1655-L1679https://github.com/nopSolutions/nopCommerce/commit/fbdbe18d43b42b7e269f7118cfc9533349ed2dc0https://github.com/nopSolutions/nopCommerce/issues/8417https://github.com/nopSolutions/nopCommerce/releases/tag/release-5.00.0https://www.vulncheck.com/advisories/nopcommerce-before-5.00.0-missing-authorization-via-admin-productcontroller-add-popup-handlers