CVE-2026-115450: Ecommerce Template affected git revisions

Affected technology

Ecommerce Template · 2aa8ec539b6b441632096ced78e099fb096a57da to before e6b364cd668f2ba875cfa7f6d55c63e771715df7
MarcosCamara01

Component: Not specified by the source
File: src/app/api/user/cart/route.ts, src/app/api/stripe/payment/route.ts

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated user with no special privileges can be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. Source advisory’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality and availability impact as none; integrity impact as high.