Marcoscamara01

An issue in the cart and checkout flow allows an authenticated user to be charged for one product while ordering another. The endpoint 'POST /api/user/cart' accepts `variantId` and `stripeId` as independent request body fields without verifying if the `stripeId` belongs to the specified `variantId`. Subsequently, the 'POST /api/stripe/payment' endpoint uses the stored `stripeId` to determine the charge amount. Finally, the checkout.session.completed webhook creates the order based on the `variantId`, resulting in orders for expensive items at the price of the cheapest item in the catalogue.

An authorization bypass exists in the cart and wishlist repositories. Authenticated users can delete or modify cart and wishlist entries belonging to other users. This occurs because the functions `cartRepository.delete()`, `cartRepository.updateQuantityInternal()`, and `wishlistRepository.delete()` match rows using only the primary key without verifying the owning user. While the system implements PostgreSQL row level security (RLS)—a security feature that restricts which rows a user can see or modify based on a policy—the policies are not applied because the application connects to the database using the same role that owns the tables. Since PostgreSQL does not apply RLS policies to the table owner by default, the restrictions are bypassed. Additionally, the use of sequential `bigserial` values for `cart items.id` and `wishlist.id` allows attackers to enumerate identifiers of other users' data.