CVE-2026-115453

Name of the Vulnerable Software and Affected Versions MarcosCamara01 Ecommerce Template (affected versions not specified)

Description An authorization bypass exists in the cart and wishlist repositories. Authenticated users can delete or modify cart and wishlist entries belonging to other users. This occurs because the functions cartRepository.delete(), cartRepository.updateQuantityInternal(), and wishlistRepository.delete() match rows using only the primary key without verifying the owning user. While the system implements PostgreSQL row level security (RLS)—a security feature that restricts which rows a user can see or modify based on a policy—the policies are not applied because the application connects to the database using the same role that owns the tables. Since PostgreSQL does not apply RLS policies to the table owner by default, the restrictions are bypassed. Additionally, the use of sequential bigserial values for cart items.id and wishlist.id allows attackers to enumerate identifiers of other users' data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.