Description
External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.
Published: 2026-10-22
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Unauthorized price manipulation and incorrect order fulfillment
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows a regular authenticated user to replace the Stripe price identifier that determines the amount charged with any price from the catalog, while retaining the original product variant in the cart. This misalignment causes the user to be billed for the cheapest item for a more expensive product, leading to financial loss and inaccurate order records.

Affected Systems

The defect exists in the MarcosCamara01 Ecommerce Template. All instances using this repository before the commit e6b364cd on 31 July 2026 are affected, because the repository has no formal version tags and the fix is only identified by that commit.

Risk and Exploitability

With a CVSS score of 7.1 and no EPSS entry, the risk is moderate to high. Any authenticated visitor can modify the POST /api/user/cart payload to supply a legitimate stripeId of a cheaper product; all stripe IDs are publicly readable, so guessing is unnecessary. The attack requires only standard HTTP requests and no privileged access, making exploitation straightforward. The vulnerability is not yet listed in CISA KEV but poses real financial and data integrity risks.

Generated by OpenCVE AI on October 22, 2026 at 16:17 UTC.

Remediation

Vendor Solution

Update to a revision of the repository that includes commit e6b364cd668f2ba875cfa7f6d55c63e771715df7 of 31 July 2026. The repository publishes no versioned releases and carries no git tags, so the fix can only be identified by commit.

OpenCVE Recommended Actions

  • Update the repository to the commit e6b364cd or later, which removes the uncontrolled stripeId field from the cart handling.
  • If code deployment pressure precludes an immediate update, modify the /api/user/cart and /api/stripe/payment logic to validate that the stripeId stored for a cart item matches the Stripe price ID associated with the selected variantId, rejecting any mismatched pairs.
  • To reduce risk while remediation is pending, restrict public exposure of Stripe price identifiers or limit the ability to specify stripeId directly to administrators only.

Generated by OpenCVE AI on October 22, 2026 at 16:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Marcoscamara01
Marcoscamara01 ecommerce-template
Vendors & Products Marcoscamara01
Marcoscamara01 ecommerce-template

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list.
Title Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier
Weaknesses CWE-472
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Marcoscamara01 Ecommerce-template
cve-icon MITRE

Status: PUBLISHED

Assigner: Secur0

Published:

Updated: 2026-10-22T15:13:37.089Z

Reserved: 2026-10-22T14:46:31.556Z

Link: CVE-2026-115450

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-22T16:17:35.027

Modified: 2026-10-22T17:40:46.877

Link: CVE-2026-115450

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T17:00:09Z

Weaknesses
  • CWE-472

    External Control of Assumed-Immutable Web Parameter