{"id":"CVE-2026-119558","kind":"vulnerability","aliases":["CVE-2026-119558"],"related":[],"title":"OpenCart: logged-in customers can place unpaid orders via reward points","description":"OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.","summary":"OpenCart through 4.1.0.4 lets a logged-in customer clear reward points after choosing Free Checkout, so the order advances without payment. An attacker gets full-price orders completed for free.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","opencart","php","runtime"],"not_affected_if":["guest-checkout-only","no-reward-points"],"how_to_check":"- Check the OpenCart version in the admin dashboard footer or `install/index.php` against the affected range through `4.1.0.4`\n- Review whether the checkout flow in your store accepts reward points and Free Checkout together","fix":null,"status":"open","published_at":"2026-10-30T12:16:43+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","triaged_at":"2026-10-30T12:34:07+00:00","updated_at":"2026-10-30T12:34:07+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T12:34:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OpenCart: logged-in customers can place unpaid orders via reward points","impact":"medium","summary":"OpenCart through 4.1.0.4 lets a logged-in customer clear reward points after choosing Free Checkout, so the order advances without payment. An attacker gets full-price orders completed for free.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["opencart","ecommerce","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Customers obtain full-price orders without paying","analyst_note":"Confirm the fixed version and whether the reward.save and Free Checkout interaction is default-enabled, using the NVD entry and the OpenCart release notes.","how_to_check":"- Check the OpenCart version in the admin dashboard footer or `install/index.php` against the affected range through `4.1.0.4`\n- Review whether the checkout flow in your store accepts reward points and Free Checkout together","plain_action":"","needs_analyst":true,"not_affected_if":["guest-checkout-only","no-reward-points"],"who_is_affected":"Stores running OpenCart 4.1.0.4 or earlier where customers can log in and use reward points at checkout. Stores that do not use reward points or that run a later release are likely not affected, but the sources do not confirm a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000674,"input_tokens":4144,"output_tokens":520,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-119558':15A,18A '-2026':14A,17A '4.1.0.4':25B,57C 'advanc':42B,101C 'allow':64C 'appli':86C 'attack':46B,84C 'busi':60C 'checkout':38B,83C,90C,106C 'choos':36B 'clear':32B,77C 'complet':52B 'confirm':99C 'contain':58C 'custom':5A,31B,68C 'cve':13A,16A 'ecommerc':19B 'free':37B,54B,82C,89C,105C 'full':49B,73C 'full-pric':48B,72C 'get':47B 'handler':100C 'let':26B 'log':3A,29B,66C 'logged-in':2A,28B,65C 'logic':61C 'opencart':1A,20B,23B,55C 'order':9A,41B,51B,75C,103C 'payment':44B,109C 'php':21B 'place':7A,70C 'point':12A,34B,79C,87C,94C 'price':50B,74C 'reward':11A,33B,78C 'reward.save':96C 'runtim':22B 'save':88C 'select':81C 'status':107C 'submit':92C 'unpaid':8A,71C 'via':10A,95C 'vulner':62C 'without':43B,108C 'zero':93C","nicknames":[],"mitigations":[],"who_affected":"Stores running OpenCart 4.1.0.4 or earlier where customers can log in and use reward points at checkout. Stores that do not use reward points or that run a later release are likely not affected, but the sources do not confirm a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119558","severity":null,"published_at":"2026-10-30T12:16:43+00:00","modified_at":"2026-10-30T12:16:43+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","fetched_at":"2026-10-30T12:30:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}