CVE-2026-115453

Deferred Deferred - Pending Action

Authorization Bypass in MarcosCamara Ecommerce Template

Publication date: 2026-10-22

Last updated on: 2026-10-22

Assigner: Secur0

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete(), cartRepository.updateQuantityInternal() and wishlistRepository.delete() in src/lib/db/drizzle/repositories/ match rows by primary key alone, with no predicate on the owning user, and the per user authorization for those three operations rests on PostgreSQL row level security. The migrations run ALTER TABLE ... ENABLE ROW LEVEL SECURITY and create policies comparing app.current_user_id() with user_id, but never ALTER TABLE ... FORCE ROW LEVEL SECURITY, and PostgreSQL does not apply policies to the role that owns a table. The template uses one DATABASE_URL both to run the migrations, which create the tables, and for the application at runtime, so the application connects as the owner of the tables and the policies do not apply to it. cart_items.id and wishlist.id are sequential bigserial values, so the identifiers of rows belonging to other users can be enumerated, and the update path returns the modified row, which carries the identifier of the user it belongs to. This results in the destruction and modification of cart and wishlist contents belonging to other accounts of the installation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-22

Last Modified

2026-10-22

Generated

2026-10-23

AI Q&A

2026-10-23

EPSS Evaluated

N/A

NVD

CVE-2026-115453

Affected Vendors & Products

Vendor	Product	Version / Range
MarcosCamara01	Ecommerce Template	b139a11c7bfab82b9c54c738b9a5d6015b439972

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template. It allows any authenticated user to delete or modify the cart and wishlist entries of other users by exploiting sequential row identifiers and insufficient PostgreSQL row-level security policies.

Impact Analysis

An attacker could manipulate or delete another user's cart or wishlist items, leading to data loss, incorrect order processing, or disruption of user experience. This could affect both customers and the business operating the template.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to user data (cart/wishlist contents) and HIPAA by compromising protected health information if stored in the cart. It undermines data integrity and access control requirements.

Mitigation Strategies

Immediately update the cart and wishlist repositories to enforce user-based authorization checks in cartRepository.delete(), cartRepository.updateQuantityInternal(), and wishlistRepository.delete(). Ensure PostgreSQL row-level security policies are enforced by setting FORCE ROW LEVEL SECURITY on affected tables. Review and restrict database role permissions to prevent application connections from bypassing security policies.

Hi! I’m here to help you understand CVE-2026-115453. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70