CVE-2026-111277 in NivoCart
Summary
by MITRE • 10/16/2026
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in NivoCart versions through 2.5.1 represents a critical failure in access control mechanisms within the application's order management module. Specifically, the download action associated with account orders lacks proper authorization checks for unauthenticated users. This flaw allows any individual without valid credentials to interact directly with the backend logic responsible for generating and serving invoice documents. By manipulating the input parameters sent to this endpoint, an attacker can bypass standard authentication protocols that should restrict access to order-related data based on user session validity or ownership verification.
The technical root cause lies in how the application validates requests against stored database records. The system appears to rely solely on the presence of a valid order identifier rather than verifying that the requesting entity is authorized to view the specific order's details. When an attacker supplies an arbitrary order_id, the backend logic proceeds to fetch and return the corresponding invoice data if it matches guest orders where the customer_id field is set to zero. This design oversight effectively treats all guest transactions as publicly accessible resources rather than private financial records protected by identity verification mechanisms.
The operational impact of this vulnerability is severe due to the sensitive nature of the exposed information. Attackers can systematically iterate through sequential or predictable order identifiers to harvest a comprehensive dataset comprising personally identifiable information and commercial details. The disclosed data includes full names, physical addresses, telephone numbers, email addresses, itemized lists of purchased products, and total transaction amounts. This mass disclosure facilitates identity theft, targeted phishing campaigns, social engineering attacks, and potential fraud against both customers and the merchant operating the platform.
From a classification perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, as well as CWE-639 regarding Authorization Bypass Through User-Controlled Key. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques involving unauthorized access to data via API endpoints and potentially enumeration through parameter manipulation. The ability to iterate identifiers suggests a lack of rate limiting or anti-brute-force protections on the endpoint, further exacerbating the risk of large-scale data exfiltration.
Mitigation strategies must prioritize implementing robust authorization checks at both the application logic level and the database query layer. Developers should ensure that every request for sensitive order information verifies not only the existence of the record but also the relationship between the authenticated user session and the requested resource, even if the original transaction was made as a guest. Implementing unique, non-sequential tokens for invoice access can prevent enumeration attacks by making it computationally infeasible to guess valid identifiers. Additionally, applying strict input validation and rate limiting on the download endpoint will help mitigate automated scraping attempts while maintaining security hygiene standards consistent with modern web application best practices.