CVE-2026-91154 in Ecommerce Template
Summary
by MITRE • 09/28/2026
Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cache at will. The file declares "use server" at file scope, so every exported function compiles into a POST-invokable Server Action; revalidateProducts calls updateTag("products") with no session or role check, unlike the read-only actions in the same file which are safe by construction. Two client components under src/components/admin import the function, which causes its Server Action id to be compiled into a public /_next/static chunk that the application's admin middleware (proxy.ts) does not gate, so any unauthenticated user can extract that id from the public bundle and invoke the action directly. With cacheComponents enabled, the entire storefront (home, categories, product pages, search) is served from "use cache" entries produced by getAllProducts, getCategoryProducts and getProduct, all tagged products with an hours-long cacheLife. Repeated unauthenticated invocation of revalidateProducts keeps that cache permanently cold, forcing every visitor's request to read the full product catalog from Postgres instead of serving from cache, degrading storefront availability at near-zero attacker cost.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified as CWE-306 represents a critical failure in access control within the MarcosCamara01 Ecommerce Template, specifically affecting the server-side action responsible for product cache revalidation. The core technical flaw lies in the implementation of the revalidateProducts function located in src/app/actions.ts. Although this file is declared with "use server" at the file scope, which compiles all exported functions into POST-invokable Server Actions, the security model fails to distinguish between administrative operations and public read-only actions. Unlike other functions in the same module that are safe by construction due to their read-only nature or implicit restrictions, revalidateProducts performs a state-changing operation—calling updateTag("products")—without implementing any session validation, authentication checks, or role-based access controls. This oversight allows the function to be executed by any entity capable of sending an HTTP POST request, regardless of user identity or privilege level.
The exploitation vector is facilitated by how Next.js compiles Server Actions into client-side bundles when imported by client components. In this specific template, two administrative components under src/components/admin import the revalidateProducts function. This import causes the server action identifier to be embedded within a public JavaScript chunk located in /_next/static. Because the application's admin middleware, proxy.ts, does not gate access to these static assets or validate the intent of requests targeting this specific action ID, an unauthenticated attacker can easily extract the necessary invocation data from the publicly accessible bundle. This architectural quirk effectively exposes a privileged administrative function through standard public endpoints, bypassing any intended server-side security boundaries that might have been expected for such sensitive operations.
The operational impact of this vulnerability is severe and directly affects service availability rather than just confidentiality or integrity. The application utilizes Next.js caching features with cacheComponents enabled, meaning the entire storefront—including home pages, category listings, product details, and search results—is served from "use cache" entries generated by functions like getAllProducts, getCategoryProducts, and getProduct. These cached responses are tagged with the identifier products and configured with a long cacheLife duration to optimize performance. By repeatedly invoking revalidateProducts without authentication, an attacker can force the expiration of this entire product tag at will. This action keeps the storefront cache permanently cold, forcing every subsequent visitor's request to bypass the fast in-memory or edge caching layer and instead query the underlying Postgres database directly for the full product catalog.
This continuous invalidation leads to a significant degradation in storefront availability and performance. The sudden spike in direct database queries can overwhelm the backend infrastructure, leading to increased latency, higher resource consumption, and potential service timeouts or crashes under load. This constitutes a low-cost denial-of-service attack where an unauthenticated user can disrupt business operations by simply sending repeated POST requests with the extracted server action payload. From a threat modeling perspective, this aligns with ATT&CK techniques related to Resource Hijacking and potentially Impact via Denial of Service, as it allows for the disruption of normal service availability through abuse of legitimate application functionality.
To mitigate this vulnerability, immediate remediation is required to enforce strict access controls on all state-changing server actions. The revalidateProducts function must be updated to include robust authentication middleware that verifies valid user sessions and confirms administrative privileges before executing any cache invalidation logic. Additionally, the architectural approach should be reviewed to ensure that sensitive server action identifiers are not unnecessarily exposed in public client-side bundles if they can be invoked directly by unauthenticated users. Implementing rate limiting on all POST endpoints serving Server Actions can also provide a secondary layer of defense against automated abuse attempts. Finally, auditing other exported functions in actions.ts for similar missing authentication checks is recommended to prevent analogous vulnerabilities from existing elsewhere in the application logic.