CVE-2026-117605
nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers
nopSolutions nopCommerce
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 5.00.0nopCommerceCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.
Text from CVE List
Affected versions 1
- nopCommerceaffected: all versions before 5.00.0CVE List
References 6
- github.com/nopSolutions/nopCommerce/commit/fbdbe18d43b42b7e269f7118cfc9533349ed2dc0Fixvia CVE List
- github.com/nopSolutions/nopCommerce/releases/tag/release-5.00.0Fixvia CVE List
- vulncheck.com/advisories/nopcommerce-before-5.00.0-missing-authorization-via-admin-productcontroller-add-popup-handlersAdvisoryvia CVE List
- github.com/nopSolutions/nopCommerce/issues/8417Referencevia CVE List
- github.com/nopSolutions/nopCommerce/blob/918444773367deb734b93d3ad80e17325d6c147a/src/Presentation/Nop.Web/Areas/Admin/Controllers/ProductController.cs#L1655-L1679Referencevia CVE List
- github.com/nopSolutions/nopCommerceReferencevia CVE List