CVE-2026-50986

Received Received - Intake

Cross-Site Request Forgery in PrestaShop totadministrativemandate Module

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: MITRE

Description

PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-07-31

Generated

2026-08-01

AI Q&A

2026-08-01

EPSS Evaluated

N/A

NVD

CVE-2026-50986

EUVD

EUVD-2026-51644

Affected Vendors & Products

Vendor	Product	Version / Range
prestashop	totadministrativemandate	to 1.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross Site Request Forgery (CSRF) issue in the PrestaShop module totadministrativemandate version before 1.8.1. The payment validation controller lacks a CSRF token, allowing an attacker to confirm orders in awaiting status by hijacking a link.

Detection Guidance

To detect this vulnerability, check the version of the totadministrativemandate module in your PrestaShop installation. If the version is below 1.8.1, the system is vulnerable. No specific commands are provided in the context to detect this issue.

Impact Analysis

An attacker could trick a user into clicking a malicious link, causing unauthorized order confirmations. This may lead to financial loss, incorrect order processing, or reputational damage for affected stores.

Compliance Impact

This CSRF vulnerability could lead to unauthorized transactions, potentially violating data integrity and confidentiality requirements under GDPR or HIPAA if personal or financial data is involved.

Mitigation Strategies

Update the PrestaShop module totadministrativemandate to version 1.8.1 or higher to address the CSRF vulnerability in the payment validation controller.

Hi! I’m here to help you understand CVE-2026-50986. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70