CVE-2026-117605 json
nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers
published 13d ago modified 12d ago also EUVD-2026-111571
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 17%
- public exploits
- 0
- none known
Summary
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
Patch / fix
- nopSolutions nopCommerce 5.00.0
Is CVE-2026-117605 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 12d ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- nopSolutions nopCommerce
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/nopSolutions/nopCommerce/commit/fbdbe18d43b42b7e269f7118cfc9533349ed2dc0
patch
-
github.com
/nopSolutions/nopCommerce/issues/8417
issue-tracking
-
github.com
/nopSolutions/nopCommerce/blob/918444773367deb734b93d3ad80e17325d6c147a/src/Presentation/Nop.Web/Areas/Admin/C
technical-description
-
github.com
/nopSolutions/nopCommerce/releases/tag/release-5.00.0
release-notes
-
github.com
/nopSolutions/nopCommerce
product
-
vulncheck.com
/advisories/nopcommerce-before-5.00.0-missing-authorization-via-admin-productcontroller-add-popup-handlers
third-party-advisory
Sources
- CVE List CVE-2026-117605
- NVD CVE-2026-117605
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.