CVE-2026-117605: nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated vendor can exploit it. The attacker needs to be able to submit a request to one of the affected admin ProductController popup handlers and supply another vendor's product ID as model.ProductId.
What is the impact on another vendor's products?
An attacker can inject their own products into another vendor's related-products, cross-sell, or grouped-product listings. The stated impact is unauthorized modification of those product associations; no confidentiality or availability impact is indicated.
Which deployments should be prioritized for remediation?
Deployments running nopCommerce before version 5.00.0 should be prioritized, particularly where multiple authenticated vendors manage products. The issue depends on vendor access and the ability to reference products owned by other vendors.