CVE-2026-117605
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Oct 28, 2026
Vendor
unknown
Description
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
References
- https://github.com/nopSolutions/nopCommerce
- https://github.com/nopSolutions/nopCommerce/blob/918444773367deb734b93d3ad80e17325d6c147a/src/Presentation/Nop.Web/Areas/Admin/Controllers/ProductController.cs#L1655-L1679
- https://github.com/nopSolutions/nopCommerce/commit/fbdbe18d43b42b7e269f7118cfc9533349ed2dc0
- https://github.com/nopSolutions/nopCommerce/issues/8417
- https://github.com/nopSolutions/nopCommerce/releases/tag/release-5.00.0