Live › vulnerability › CVE-2026-117605
Go to dashboardnopCommerce versions before 5.00.0 fail to check product ownership in the admin related, cross-sell and grouped product handlers. An authenticated vendor can attach their own products to another vendor's product listings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Stores running nopCommerce before that have multiple vendor accounts with admin product access. Single-vendor stores with no vendor role are unlikely to be exposed. unknown whether other configurations are affected.
5.00.0No product ranges from the sources yet.
5.00.05.00.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
This page as .md · .json · in your agent: get_signal("CVE-2026-117605")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.