CVE-2026-115450

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115450", "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "state": "PUBLISHED", "assignerShortName": "Secur0", "dateReserved": "2026-10-22T14:46:31.556Z", "datePublished": "2026-10-22T15:13:37.089Z", "dateUpdated": "2026-10-30T18:47:42.157Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "shortName": "Secur0", "dateUpdated": "2026-10-26T11:09:07.323Z"}, "title": "Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-472", "description": "CWE-472 External Control of Assumed-Immutable Web Parameter", "type": "CWE"}]}], "affected": [{"vendor": "MarcosCamara01", "product": "Ecommerce Template", "repo": "https://github.com/MarcosCamara01/ecommerce-template", "programFiles": ["src/app/api/user/cart/route.ts", "src/app/api/stripe/payment/route.ts"], "versions": [{"status": "affected", "version": "2aa8ec539b6b441632096ced78e099fb096a57da", "lessThan": "e6b364cd668f2ba875cfa7f6d55c63e771715df7", "versionType": "git"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:marcoscamara01:ecommerce-template:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because <code>POST /api/user/cart</code> accepts <code>variantId</code>, which determines what the order records, and <code>stripeId</code>, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the <code>stripeId</code> to be the one that belongs to the <code>variantId</code>. <code>POST /api/stripe/payment</code> builds the Stripe Checkout line items from the stored value, as <code>{ price: item.stripeId, quantity }</code>, so the amount charged is the amount of that Stripe price. The <code>checkout.session.completed</code> webhook then creates the order products from the <code>variantId</code> of the same cart row, so the order records a product that was not paid for. Every <code>stripeId</code> in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list."}]}], "tags": ["x_open-source"], "references": [{"url": "https://github.com/MarcosCamara01/ecommerce-template/commit/e6b364cd668f2ba875cfa7f6d55c63e771715df7", "tags": ["patch"]}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-115450-price-manipulation-stripe-checkout", "tags": ["third-party-advisory", "technical-description"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "Update to a revision of the repository that includes commit e6b364cd668f2ba875cfa7f6d55c63e771715df7 of 31 July 2026. The repository publishes no versioned releases and carries no git tags, so the fix can only be identified by commit.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update to a revision of the repository that includes commit <code>e6b364cd668f2ba875cfa7f6d55c63e771715df7</code> of 31 July 2026. The repository publishes no versioned releases and carries no git tags, so the fix can only be identified by commit."}]}], "credits": [{"lang": "en", "value": "Dar\u00edo Rivas", "type": "finder"}, {"lang": "en", "value": "Gerard Martinez Guillamon", "type": "finder"}, {"lang": "en", "value": "Cristian Fern\u00e1ndez Cornejo", "type": "analyst"}, {"lang": "en", "value": "Xo\u00e1n M. Otero Jorge", "type": "analyst"}, {"lang": "en", "value": "Secur0 CNA", "type": "coordinator"}, {"lang": "en", "value": "MarcosCamara01", "type": "remediation developer"}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T18:47:03.842052Z", "id": "CVE-2026-115450", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T18:47:42.157Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115450", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T18:47:03.842052Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T18:47:36.511Z"}}], "cna": {"tags": ["x_open-source"], "title": "Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Dar\u00edo Rivas"}, {"lang": "en", "type": "finder", "value": "Gerard Martinez Guillamon"}, {"lang": "en", "type": "analyst", "value": "Cristian Fern\u00e1ndez Cornejo"}, {"lang": "en", "type": "analyst", "value": "Xo\u00e1n M. Otero Jorge"}, {"lang": "en", "type": "coordinator", "value": "Secur0 CNA"}, {"lang": "en", "type": "remediation developer", "value": "MarcosCamara01"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:marcoscamara01:ecommerce-template:*:*:*:*:*:*:*:*"], "repo": "https://github.com/MarcosCamara01/ecommerce-template", "vendor": "MarcosCamara01", "product": "Ecommerce Template", "versions": [{"status": "affected", "version": "2aa8ec539b6b441632096ced78e099fb096a57da", "lessThan": "e6b364cd668f2ba875cfa7f6d55c63e771715df7", "versionType": "git"}], "programFiles": ["src/app/api/user/cart/route.ts", "src/app/api/stripe/payment/route.ts"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to a revision of the repository that includes commit e6b364cd668f2ba875cfa7f6d55c63e771715df7 of 31 July 2026. The repository publishes no versioned releases and carries no git tags, so the fix can only be identified by commit.", "supportingMedia": [{"type": "text/html", "value": "Update to a revision of the repository that includes commit <code>e6b364cd668f2ba875cfa7f6d55c63e771715df7</code> of 31 July 2026. The repository publishes no versioned releases and carries no git tags, so the fix can only be identified by commit.", "base64": false}]}], "references": [{"url": "https://github.com/MarcosCamara01/ecommerce-template/commit/e6b364cd668f2ba875cfa7f6d55c63e771715df7", "tags": ["patch"]}, {"url": "https://secur0.com/en/cna/cve-list/cve-2026-115450-price-manipulation-stripe-checkout", "tags": ["third-party-advisory", "technical-description"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.", "supportingMedia": [{"type": "text/html", "value": "External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because <code>POST /api/user/cart</code> accepts <code>variantId</code>, which determines what the order records, and <code>stripeId</code>, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the <code>stripeId</code> to be the one that belongs to the <code>variantId</code>. <code>POST /api/stripe/payment</code> builds the Stripe Checkout line items from the stored value, as <code>{ price: item.stripeId, quantity }</code>, so the amount charged is the amount of that Stripe price. The <code>checkout.session.completed</code> webhook then creates the order products from the <code>variantId</code> of the same cart row, so the order records a product that was not paid for. Every <code>stripeId</code> in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-472", "description": "CWE-472 External Control of Assumed-Immutable Web Parameter"}]}], "providerMetadata": {"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "shortName": "Secur0", "dateUpdated": "2026-10-26T11:09:07.323Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115450", "state": "PUBLISHED", "dateUpdated": "2026-10-30T18:47:42.157Z", "dateReserved": "2026-10-22T14:46:31.556Z", "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a", "datePublished": "2026-10-22T15:13:37.089Z", "assignerShortName": "Secur0"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:marcoscamara01:ecommerce-template:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Ecommerce Template", "programFiles": ["src/app/api/user/cart/route.ts", "src/app/api/stripe/payment/route.ts"], "repo": "https://github.com/MarcosCamara01/ecommerce-template", "vendor": "MarcosCamara01", "versions": [{"lessThan": "e6b364cd668f2ba875cfa7f6d55c63e771715df7", "status": "affected", "version": "2aa8ec539b6b441632096ced78e099fb096a57da", "versionType": "git"}]}], "source": "4daa8cea-433a-44bd-9456-53b127fc289a"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list."}], "id": "CVE-2026-115450", "lastModified": "2026-10-30T19:18:12.293", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115450", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T18:47:03.842052Z", "version": "2.0.3"}}]}, "published": "2026-10-22T16:17:35.027", "references": [{"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "url": "https://github.com/MarcosCamara01/ecommerce-template/commit/e6b364cd668f2ba875cfa7f6d55c63e771715df7"}, {"source": "4daa8cea-433a-44bd-9456-53b127fc289a", "url": "https://secur0.com/en/cna/cve-list/cve-2026-115450-price-manipulation-stripe-checkout"}], "sourceIdentifier": "4daa8cea-433a-44bd-9456-53b127fc289a", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-472"}], "source": "4daa8cea-433a-44bd-9456-53b127fc289a", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2aa8ec539b6b441632096ced78e099fb096a57da, e6b364cd668f2ba875cfa7f6d55c63e771715df7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Ecommerce Template", "source": "cna", "vendor": "MarcosCamara01"}, "product": "ecommerce-template", "vendor": "marcoscamara01"}], "created": "2026-10-22T16:30:08.802998+00:00", "updated": "2026-10-22T17:00:09.630284+00:00", "vendors": ["marcoscamara01", "marcoscamara01$PRODUCT$ecommerce-template"]}