CVE-2026-94105: NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller
NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the configpassword setting to 0, disabling self-service password recovery until an administrator manually re-enables it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NivoCartto a version that resolves this vulnerability.Fixed in 2.4.0 - Configuration
Re-enable self-service password recovery by manually setting the config_password setting back to enabled (to undo the attacker-written value of 0).
NivoCart admin password reset controller config_password = 1 (re-enable self-service password recovery)
Event History
Frequently Asked Questions
What access does an attacker need to trigger the issue?
No authentication or user interaction is required. An attacker can send a GET request to the admin password reset controller with a missing or incorrect code parameter.
What is the operational impact if exploitation succeeds?
The config_password setting is rewritten to 0, disabling self-service password recovery. Password recovery remains unavailable until an administrator manually re-enables the setting.
How can administrators determine whether they may already be affected?
Check whether self-service password recovery is disabled and inspect the config_password setting. A value of 0 indicates that password recovery has been disabled.
What can be done if updating is not immediately possible?
Administrators can manually re-enable password recovery after an incident. Because the affected controller can be reached without authentication, monitoring for requests to the admin password reset controller with missing or invalid code parameters may help identify attempted exploitation.