{"id":"CVE-2026-117605","kind":"vulnerability","aliases":["CVE-2026-117605"],"related":[],"title":"nopCommerce: vendors can add products to other vendors' listings","description":"nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.","summary":"nopCommerce versions before 5.00.0 fail to check product ownership in the admin related, cross-sell and grouped product handlers. An authenticated vendor can attach their own products to another vendor's product listings.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","multi-vendor","nopcommerce","package","self-hosted"],"not_affected_if":["nopcommerce-5.00.0-or-later","single-vendor"],"how_to_check":"- Check the installed nopCommerce version and compare it against `5.00.0`\n- Review whether vendor accounts can reach the admin product pages in your store","fix":"- Upgrade nopCommerce to `5.00.0` or later\n- Until upgraded, restrict vendor accounts from admin product pages if your setup allows it","status":"open","published_at":"2026-10-28T03:17:11+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:48+00:00","updated_at":"2026-10-28T03:32:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T03:32:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade nopCommerce to `5.00.0` or later\n- Until upgraded, restrict vendor accounts from admin product pages if your setup allows it","reach":"internet","title":"nopCommerce: vendors can add products to other vendors' listings","impact":"low","summary":"nopCommerce versions before 5.00.0 fail to check product ownership in the admin related, cross-sell and grouped product handlers. An authenticated vendor can attach their own products to another vendor's product listings.","category":"package","nicknames":[],"who_cares":["nopcommerce","ecommerce","multi-vendor","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Vendor injects own products into another vendor's listings","analyst_note":"","how_to_check":"- Check the installed nopCommerce version and compare it against `5.00.0`\n- Review whether vendor accounts can reach the admin product pages in your store","needs_analyst":false,"not_affected_if":["nopcommerce-5.00.0-or-later","single-vendor"],"who_is_affected":"Stores running nopCommerce before `5.00.0` that have multiple vendor accounts with admin product access. Single-vendor stores with no vendor role are unlikely to be exposed. unknown whether other configurations are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00058,"input_tokens":3357,"output_tokens":489,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117605':12A,15A '-2026':11A,14A '5.00.0':28B,61C 'add':4A 'admin':36B,69C 'anoth':54B,87C 'associatedproductaddpopup':74C 'attach':49B 'authent':46B,83C 'author':65C 'check':31B 'contain':62C 'cross':39B,106C 'cross-sel':38B,105C 'crosssellproductaddpopup':72C 'cve':10A,13A 'ecommerc':16B 'fail':29B,77C 'group':42B,110C 'grouped-product':109C 'handler':44B,75C 'host':24B 'id':91C 'inject':95C 'list':9A,58B,112C 'miss':64C 'model.productid':93C 'multi':18B 'multi-vendor':17B 'nopcommerc':1A,20B,25B,59C 'ownership':33B,82C 'packag':21B 'parent':80C 'product':5A,32B,43B,52B,57B,81C,90C,97C,104C,111C 'productcontrol':70C 'relat':37B,103C 'related-product':102C 'relatedproductaddpopup':71C 'self':23B 'self-host':22B 'sell':40B,107C 'submit':86C 'vendor':2A,8A,19B,47B,55B,84C,88C 'verifi':79C 'version':26B 'victim':100C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Stores running nopCommerce before `5.00.0` that have multiple vendor accounts with admin product access. Single-vendor stores with no vendor role are unlikely to be exposed. unknown whether other configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117605","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117605","severity":null,"published_at":"2026-10-28T03:17:11+00:00","modified_at":"2026-10-28T03:17:11+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}