CVE-2026-94105
Received Received - Intake

NivoCart Admin Password Reset Configuration Write Vulnerability

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulnCheck

Description
NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-94105
EUVD
EUVD-2026-83725

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nivocart nivocart to 2.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

NivoCart through version 2.4.0 has a vulnerability where unauthenticated attackers can disable password recovery by sending a GET request with a missing or incorrect code to the admin password reset controller. This rewrites the config_password setting to 0, disabling self-service password recovery until manually re-enabled.

Detection Guidance

Check NivoCart admin password reset functionality by sending a GET request without a valid code parameter. If the config_password setting is set to 0 afterward, the system is vulnerable. Example: curl -X GET 'http://<target>/admin/index.php?route=common/reset&code=invalid'

Inspect server logs for unusual GET requests to /admin/index.php?route=common/reset with missing or incorrect code parameters.

Impact Analysis

This vulnerability allows attackers to disable password recovery for all users, preventing legitimate password resets. Users would be unable to recover accounts without administrator intervention, leading to potential account lockouts and service disruptions.

Compliance Impact

This vulnerability could impact compliance by preventing users from resetting passwords, which may violate data access and security requirements under GDPR and HIPAA. Organizations must ensure users can recover access to accounts to maintain compliance with authentication and data protection standards.

Mitigation Strategies

Upgrade NivoCart to a version beyond 2.4.0 where this vulnerability is patched. If upgrading is not possible, restrict access to the admin password reset endpoint via firewall rules or web server configuration.

Manually verify the config_password setting is not set to 0 and re-enable password recovery if it has been disabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94105. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart