CVE-2026-117605 in nopCommerce
Summary
by MITRE • 10/28/2026
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in nopCommerce versions prior to 5.00.0 represents a critical failure in access control mechanisms within the administrative interface, specifically affecting product management functionalities. This flaw is categorized under CWE-284 Improper Access Control, where an application fails to properly verify that a user has permission to perform actions on specific resources. The core technical issue lies in the backend handlers for RelatedProductAddPopup, CrossSellProductAddPopup, and AssociatedProductAddPopup within the ProductController. These endpoints are designed to allow administrators or vendors to associate products with one another through various relationship types such as related items, cross-sells, or grouped product bundles. However, the implementation lacks a crucial validation step that checks whether the authenticated user owns the parent product being modified. Instead of verifying ownership against the session's identity and permissions, the system relies solely on the ProductId provided in the request payload by the client side.
This architectural oversight allows for a severe Business Logic Error where an authenticated vendor can manipulate the database to inject their own products into another vendor’s catalog listings. By submitting a maliciously crafted POST request containing the productId of a product owned by a different vendor, the attacker exploits the missing authorization check. The server processes this request without confirming that the current user has administrative rights over the target parent product. Consequently, the system associates the attacker's product with the victim's listing as if it were authorized by the legitimate owner. This type of attack is consistent with CWE-639 Authorization Bypass Through User-Controlled Key, where an application uses a key provided by the user to access data without verifying that the user has permission for that specific resource.
The operational impact of this vulnerability extends beyond simple defacement or minor disruption; it fundamentally compromises the integrity and trustworthiness of the e-commerce platform's product catalog. Attackers can promote their own merchandise alongside high-traffic products owned by competitors, effectively engaging in unauthorized affiliate marketing or search engine optimization manipulation. This not only misleads customers who may assume these associations are curated by the store owner but also dilutes brand reputation for legitimate vendors whose catalogs have been tampered with. Furthermore, if the associated products contain malicious links or lead to phishing sites, it can expose end-users to security risks while damaging the platform's credibility. From a threat modeling perspective using MITRE ATT&CK, this behavior aligns with techniques found in T1530 Data from Information Repositories and potentially T1498 Network Denial of Service if used to clutter catalogs, though its primary classification remains unauthorized data modification within an application layer context.
Mitigation strategies must focus on implementing robust server-side authorization checks that validate the relationship between the authenticated user's identity and the resource being modified. Developers should ensure that every endpoint handling product associations verifies that the requesting user is either a super-administrator with global privileges or the specific vendor who owns the parent product identified in the request. This involves querying the database to confirm ownership before processing any changes to related, cross-sell, or grouped-product tables. Additionally, implementing strict input validation and using anti-forgery tokens can help prevent some forms of automated exploitation, but they do not replace the need for proper access control logic. Upgrading to nopCommerce version 5.00.0 or later is essential as these versions address this specific authorization flaw by enforcing correct ownership verification in the ProductController handlers. Until an upgrade is performed, administrators should restrict administrative access strictly to trusted individuals and monitor logs for unusual patterns of product association requests originating from vendor accounts accessing resources outside their expected scope.