Authorization Bypass in MarcosCamara01 Ecommerce Template

CVE-2026-115453

What is CVE-2026-115453?

The vulnerability in the MarcosCamara01 Ecommerce Template allows any authenticated user to manipulate another user's cart and wishlist due to insufficient authorization checks. Specifically, operations that should restrict access are based solely on primary keys, failing to enforce user ownership. Without proper row-level security applied to the database, users can exploit predictable sequential IDs to identify and modify cart and wishlist items of other users. This flaw underscores the importance of robust authorization mechanisms to protect user data across multi-user applications.

References