Threat Investigation

CVE-2026-117605

Medium

Description

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product id as model.ProductId to inject their products into the victim's related-products, cross-sell and grouped-product listings.

SeverityMedium

CVSS4.3

Exploit probability—

Product

nopCommerce

PublishedOct 28, 2026

First seenOct 28, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Update

nopSolutions nopCommerce5.00.0 or later

Patches

github.com/nopSolutions/nopCommerce/commit/fbdbe18d43b42b7e269f7118cfc9533349ed2dc0

Vendor advisories

github.com/nopSolutions/nopCommerce/releases/tag/release-5.00.0

Affected products

Product	Affected versions	Fixed in
nopSolutions nopCommerce	v < 5.00.0	5.00.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.