CVE-2026-94105 in NivoCart
Summary
by MITRE • 09/20/2026
NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/20/2026
The vulnerability identified in NivoCart versions up to 2.4.0 represents a critical configuration manipulation flaw within the administrative authentication subsystem. Specifically, this issue resides in the admin password reset controller, which is designed to facilitate self-service recovery of administrator credentials through a code-based verification process. The core technical deficiency lies in the insufficient validation and sanitization of input parameters before they are processed for persistent storage. When an unauthenticated actor interacts with the password reset endpoint by submitting a GET request containing either a missing or invalid code parameter, the application logic fails to reject this malformed input appropriately. Instead, it proceeds to execute a write operation that alters the system configuration state. This behavior indicates a fundamental flaw in how the application handles error conditions and boundary cases during critical administrative operations, allowing external inputs to directly influence internal security settings without proper authorization checks or integrity verification.
From an operational perspective, this vulnerability enables unauthenticated attackers to perform a denial of service attack against the administrator authentication mechanism by disabling password recovery capabilities entirely. By forcing the config_password setting to zero, the attacker effectively locks out legitimate administrators who may have forgotten their credentials and rely on the self-service reset functionality for access restoration. This action does not necessarily prevent login with known valid credentials but severely hampers incident response and administrative maintenance activities that require credential rotation or recovery. The impact is particularly severe in environments where automated monitoring detects admin lockouts as indicators of compromise, potentially triggering unnecessary security alerts while masking the actual malicious intent behind a simple configuration change. Furthermore, this disruption can lead to significant downtime if administrators are unable to regain access through alternative means and must resort to manual database edits or server-level interventions to restore functionality.
This vulnerability aligns with CWE-693, which describes Protection Mechanism Failure where an application fails to protect resources from unauthorized actions due to a flaw in its security controls. Additionally, the exploitation technique maps to MITRE ATT&CK tactic TA0005, specifically Defense Evasion techniques such as T1552 Unsecured Credentials or more broadly T1489 Service Stop if viewed through the lens of disrupting administrative availability. The attack vector is classified as Network Accessible with Low Complexity since it requires no prior authentication and can be executed via standard HTTP requests. This highlights a critical gap in the application's security architecture, where configuration changes that directly impact security posture are not adequately guarded by access control mechanisms or input validation routines.
To mitigate this vulnerability, immediate remediation should focus on implementing strict input validation for all parameters passed to administrative controllers, ensuring that only valid and expected values trigger state-changing operations. Developers must enforce authentication checks even during password reset flows if the operation modifies persistent configuration settings rather than just session data. Implementing a whitelist approach for allowed code formats and verifying their existence in the database before proceeding with any write operations is essential. Additionally, introducing rate limiting on administrative endpoints can help mitigate brute-force attempts to exploit this flaw. For existing deployments, administrators should manually verify that the config_password setting remains enabled and consider implementing additional monitoring alerts for changes to critical configuration files or database entries related to authentication settings. Regular security audits focusing on input validation in admin-facing modules are recommended to prevent similar misconfigurations in other parts of the application.