Marcoscamara01 Ecommerce Template
Missing authentication in the product cache revalidation Server Action allows a remote, unauthenticated attacker to force the expiration of the entire storefront product cache. The function `revalidateProducts()` in `src/app/actions.ts` calls `updateTag("products")` without performing session or role checks. Because the file uses the "use server" directive, the function is compiled into a POST-invokable Server Action. The action ID is exposed in a public `/ next/static` chunk, which is not protected by the admin middleware in `proxy.ts`. When `cacheComponents` is enabled, the storefront relies on cached entries from `getAllProducts()`, `getCategoryProducts()`, and `getProduct()`. Repeatedly invoking the vulnerable action keeps the cache cold, forcing the application to read the full product catalog from the Postgres database for every request, which degrades storefront availability.