CVE-2026-117605
nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers
CVSS Score
4.3
EPSS Score
0.3%
EPSS Percentile
18th
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
| CWE | CWE-639 |
| Vendor | nopsolutions |
| Product | nopcommerce |
| Published | Oct 28, 2026 |
| Last Updated | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for nopsolutions nopcommerce
Be the first to know when new medium vulnerabilities affecting nopsolutions nopcommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
nopSolutions / nopCommerce
0 < 5.00.0
References
github.com: https://github.com/nopSolutions/nopCommerce/issues/8417 github.com: https://github.com/nopSolutions/nopCommerce/commit/fbdbe18d43b42b7e269f7118cfc9533349ed2dc0 github.com: https://github.com/nopSolutions/nopCommerce/blob/918444773367deb734b93d3ad80e17325d6c147a/src/Presentation/Nop.Web/Areas/Admin/Controllers/ProductController.cs#L1655-L1679 github.com: https://github.com/nopSolutions/nopCommerce/releases/tag/release-5.00.0 github.com: https://github.com/nopSolutions/nopCommerce vulncheck.com: https://www.vulncheck.com/advisories/nopcommerce-before-5.00.0-missing-authorization-via-admin-productcontroller-add-popup-handlers
Credits
hieuPenguinnn