MarcosCamara01 Ecommerce Template Checkout Flow /api/user/cart variantId/stripeId external control of assumed-immutable web parameter

Summaryinfo

A vulnerability classified as problematic was found in MarcosCamara01 Ecommerce Template. Impacted is an unknown function of the file /api/user/cart of the component Checkout Flow. Executing a manipulation of the argument variantId/stripeId can lead to external control of assumed-immutable web parameter. This vulnerability is registered as CVE-2026-115450. It is possible to launch the attack remotely. No exploit is available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in MarcosCamara01 Ecommerce Template (version unknown). It has been declared as problematic. This vulnerability affects an unknown function of the file /api/user/cart of the component Checkout Flow. The manipulation of the argument variantId/stripeId with an unknown input leads to a external control of assumed-immutable web parameter vulnerability. The CWE definition for the vulnerability is CWE-472. The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields. As an impact it is known to affect integrity, and availability. CVE summarizes:

External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-115450 since 10/22/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Applying the patch e6b364cd668f2ba875cfa7f6d55c63e771715df7 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• E-Commerce Management Software

Vendor

• MarcosCamara01

Name

• Ecommerce Template

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion