The vulnerability is an authorization bypass that allows any authenticated user to delete or update the cart or wishlist rows of other users. It arises from repository queries that match rows solely by their primary key, with no condition on the owning user. Because PostgreSQL row‑level security policies are not enforced for the table‑owner role and the policies are not forced, the application can read, modify or delete any record. The result is a loss of integrity and confidentiality for user shopping data, potentially leading to financial loss or reputational damage. Risk assessment: The CVSS score is 7.1, which classifies the issue as High severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the known exploitation scenario relies on enumeration of sequential bigserial identifiers and an authenticated session, making the attack plausible on a running installation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a legitimate authenticated user abusing the lack of owner‑based checks to impact other user accounts.

MarcosCamara01’s Ecommerce Template is affected. Instances running the source built from the repository without applying the commit adf7dedbb41894c0bad0b33a26999b0da7e967b7 (dated 27 July 2026) are vulnerable. The vulnerability exists in the cart and wishlist modules that rely on a single DATABASE_URL connected as the table owner, which bypasses row‑level security.

The CVSS score of 7.1 indicates a High severity. Because the EPSS score is not provided, the exploitation probability is unclear, but the vulnerability can be exploited by enumerating sequential primary keys in the cart and wishlist tables using any authenticated session. The application’s use of the table‑owner role prevents row‑level security policies from firing, allowing any user to delete or modify other users’ rows. The vulnerability is not listed in the CISA KEV catalog, so no known exploits have been reported yet.