A missing authorization check in the admin ProductController Add Popup handlers allows an authenticated vendor to submit another vendor’s product ID and have that product added to the victim’s related‐product, cross‐sell, or grouped‑product listings. This flaw provides the attacker with the ability to manipulate product relationships and listings without consent, which can degrade data integrity and potentially distort ordering or recommendation logic. The weakness is a classic example of CWE‑639, an authorization bypass, and results in unauthorized product manipulation rather than code execution.

The vulnerability affects nopCommerce releases prior to version 5.00.0. All products from nopSolutions under the nopCommerce suite that have not yet been upgraded to the fixed 5.00.0 release are susceptible.

The CVSS score of 5.3 classifies the issue as moderate in severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated vendor account with access to the admin area; the attacker merely needs to send a request containing another vendor’s product ID to the Add Popup endpoints. The attack vector is straightforward once credentials exist, making it relatively easy to abuse in multi‑vendor environments.