Medium severity · published Oct 28, 2026
CVE-2026-117605
nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers
New
4.3
CVSS
–
EPSS
No
On KEV
Description
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
nopCommerce · nopSolutions
before 5.00.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117605
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117605
issue-tracking
https://github.com/nopSolutions/nopCommerce/issues/8417
patch
https://github.com/nopSolutions/nopCommerce/commit/fbdbe18d43b42b7e269f7118cfc9533349ed2dc0
technical-description
https://github.com/nopSolutions/nopCommerce/blob/918444773367deb734b93d3ad80e17325d6c147a/src/Presentation/Nop.Web/Areas/Admin/Controllers/ProductController.cs#L1655-L1679
release-notes
https://github.com/nopSolutions/nopCommerce/releases/tag/release-5.00.0
product
https://github.com/nopSolutions/nopCommerce
third-party-advisory
https://www.vulncheck.com/advisories/nopcommerce-before-5.00.0-missing-authorization-via-admin-productcontroller-add-popup-handlers