{"id":"CVE-2026-111277","title":"NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id","summary":"NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the or…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-862"],"vendor":"nivocart","product":"nivocart","affected":["nivocart <= 2.5.1"],"published":"2026-10-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:17:13.750","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111277","references":[{"url":"https://github.com/nivocart/nivocart","label":"disclosure@vulncheck.com"},{"url":"https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/account/order.php#L695-L770","label":"disclosure@vulncheck.com"},{"url":"https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/model/account/order.php#L11-L12","label":"disclosure@vulncheck.com"},{"url":"https://github.com/nivocart/nivocart/issues/26","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/nivocart-through-2.5.1-guest-order-invoice-disclosure-via-account-order-download","label":"disclosure@vulncheck.com"},{"url":"https://github.com/nivocart/nivocart/issues/26","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00478,"epssPercentile":0.41042,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T14:33:36.792608Z"},"ingestedAt":"2026-10-15T22:48:25.448Z","slug":"CVE-2026-111277","body":"## Overview\n\nNivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":223053,"id":"CVE-2026-111277","ts":1792164097404,"field":"exploit_available","old":"false","new":"true"}]}