CVE-2026-115453: Ecommerce Template affected git revisions

Affected technology

Ecommerce Template · b139a11c7bfab82b9c54c738b9a5d6015b439972 to before adf7dedbb41894c0bad0b33a26999b0da7e967b7
MarcosCamara01

Description’s affected range: Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template

Component: Not specified by the source
File: src/lib/db/drizzle/repositories/cart.repository.ts, src/lib/db/drizzle/repositories/wishlist.repository.ts, src/lib/db/drizzle/connection.ts

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Any authenticated user can delete and modify the cart and wishlist rows of any other user, because cartRepository.delete(), cartRepository.updateQuantityInternal() and wishlistRepository.delete() in src/lib/db/drizzle/repositories/ match rows by primary key alone, with no predicate on the owning user, and the per user authorization for those three operations rests on PostgreSQL row level security. Source advisory’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as low; integrity impact as high; availability impact as none.