CVE-2026-111277

7.5High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-862

Impact

Unauthenticated remote attackers can download guest invoices containing customer names, addresses, phone numbers, emails, and order totals. All they need is network access to the web app to iterate order IDs.

Root cause

The download action in the account/order controller lacks an authorization check, allowing any unauthenticated request to query guest orders stored with a customer ID of zero.

Affected systems

NivoCart through 2.5.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

No fixed version is specified in the advisory; check the upstream repository for patches. Block unauthenticated access to the account/order/download route at your reverse proxy or web application firewall as an interim workaround.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111277