External Control of Web Parameters in Ecommerce Template by MarcosCamara01
CVE-2026-115450

7.1HIGH

Key Information:

Vendor

Marcoscamara01

Status
Ecommerce Template
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115450?

An external control vulnerability exists in the cart and checkout flow of the Ecommerce Template by MarcosCamara01. This flaw allows an authenticated user without special privileges to exploit the system by being charged the price of one product while ordering another. The vulnerability arises because the application's API allows users to specify independent variantId and stripeId fields. No validation ensures that the stripeId corresponds to the variantId being purchased. As a result, users can manipulate the system to create orders for goods at the lowest price available in the catalogue, leading to potential financial losses for the vendor.

Affected Version(s)

Ecommerce Template 2aa8ec539b6b441632096ced78e099fb096a57da

References

https://github.com/MarcosCamara01/ecommerce-template/comm...
patch
https://secur0.com/en/cna/cve-list/cve-2026-115450-price-...
third-party-advisorytechnical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

DarĂ­o Rivas
Gerard Martinez Guillamon
Cristian Fernández Cornejo
Xoán M. Otero Jorge
Secur0 CNA
MarcosCamara01
.