{"schema":"threatline.record/2","record":{"id":"CVE-2026-111277","aliases":[],"summary":"NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download","details":"NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.","categories":["Unclassified"],"product":"nivocart","vendor":"nivocart","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111277","source_modified_at":"2026-10-16T14:36:04.161Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"nivocart","vendor":"nivocart","versions":[{"version":"0","status":"affected","versionType":"semver","lessThanOrEqual":"2.5.1"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00364,"percentile":0.29127,"score_date":"2026-10-23"},"published_at":"2026-10-15T21:43:22.473Z","modified_at":"2026-10-16T14:36:04.161Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111277","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T14:36:04.161Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111277","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/nivocart/nivocart/issues/26","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/account/order.php#L695-L770","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/model/account/order.php#L11-L12","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/nivocart/nivocart","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/nivocart-through-2.5.1-guest-order-invoice-disclosure-via-account-order-download","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-16T14:33:36.792608Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T14:36:04.161Z","content_hash":"aa8732c762d7c3059e15b141dee250ba2e8067eb7048684dfad20c83a3c1b756"}}