MarcosCamara01 Ecommerce Template Cache Revalidation src/app/actions.ts revalidateProducts missing authentication

Summaryinfo

A vulnerability identified as problematic has been detected in MarcosCamara01 Ecommerce Template. Affected is the function revalidateProducts of the file src/app/actions.ts of the component Cache Revalidation. This manipulation causes missing authentication. This vulnerability is handled as CVE-2026-91154. The attack can be initiated remotely. There is not any exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in MarcosCamara01 Ecommerce Template (affected version not known). It has been declared as problematic. Affected by this vulnerability is the function revalidateProducts of the file src/app/actions.ts of the component Cache Revalidation. The manipulation with an unknown input leads to a missing authentication vulnerability. The CWE definition for the vulnerability is CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. As an impact it is known to affect availability. The summary by CVE is:

Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cache at will. The file declares "use server" at file scope, so every exported function compiles into a POST-invokable Server Action; revalidateProducts calls updateTag("products") with no session or role check, unlike the read-only actions in the same file which are safe by construction. Two client components under src/components/admin import the function, which causes its Server Action id to be compiled into a public /_next/static chunk that the application's admin middleware (proxy.ts) does not gate, so any unauthenticated user can extract that id from the public bundle and invoke the action directly. With cacheComponents enabled, the entire storefront (home, categories, product pages, search) is served from "use cache" entries produced by getAllProducts, getCategoryProducts and getProduct, all tagged products with an hours-long cacheLife. Repeated unauthenticated invocation of revalidateProducts keeps that cache permanently cold, forcing every visitor's request to read the full product catalog from Postgres instead of serving from cache, degrading storefront availability at near-zero attacker cost.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-91154 since 09/14/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Applying the patch ec97209 is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Vendor

• MarcosCamara01

Name

• Ecommerce Template

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion