---
id: "CVE-2026-117605"
kind: "vulnerability"
aliases: ["CVE-2026-117605"]
title: "nopCommerce: vendors can add products to other vendors' listings"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "multi-vendor", "nopcommerce", "package", "self-hosted"]
not_affected_if: ["nopcommerce-5.00.0-or-later", "single-vendor"]
published_at: "2026-10-28T03:17:11+00:00"
first_seen_at: "2026-10-28T03:31:02+00:00"
updated_at: "2026-10-28T03:32:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117605", "first_seen_at": "2026-10-28T03:31:02+00:00"}]
---

# nopCommerce: vendors can add products to other vendors' listings

nopCommerce versions before 5.00.0 fail to check product ownership in the admin related, cross-sell and grouped product handlers. An authenticated vendor can attach their own products to another vendor's product listings.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed nopCommerce version and compare it against `5.00.0`
- Review whether vendor accounts can reach the admin product pages in your store

## Fix

- Upgrade nopCommerce to `5.00.0` or later
- Until upgraded, restrict vendor accounts from admin product pages if your setup allows it

## Timeline

- 2026-10-28T03:31:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117605

## From the sources

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_