Missing Authorization Vulnerability in NivoCart E-commerce Platform
CVE-2026-111277

8.7HIGH

Key Information:

Vendor

Nivocart

Status
Nivocart
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111277?

NivoCart versions up to 2.5.1 are susceptible to a missing authorization flaw that affects the download() action within the account/order context. This vulnerability permits unauthenticated attackers to access sensitive guest order invoices by manipulating the order_id parameter. Attackers can iterate over possible order_ids linked to guest accounts (with customer_id set to 0), which exposes personal information such as names, addresses, phone numbers, email addresses, purchased items, and totals. This security risk can lead to significant data privacy violations for individuals whose order details become publicly accessible.

Affected Version(s)

nivocart 0 <= 2.5.1

References

https://github.com/nivocart/nivocart/issues/26
issue-tracking
https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed98...
technical-description
https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed98...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aaron Amran Bin Amiruddin (@aaronamran)
.