Missing Authorization in nopCommerce Admin Product Controllers

CVE-2026-117605

What is CVE-2026-117605?

nopCommerce versions before 5.00.0 exhibit a missing authorization issue in their admin ProductController related handlers. This vulnerability allows authenticated vendors to manipulate the system by submitting product IDs associated with other vendors. As a result, vendors may improperly inject their products into another vendor's product listings, including related products and cross-sell configurations. This lack of ownership verification poses significant risks to product data integrity within the platform, enabling unauthorized modifications and potential reputational damage.

References