NivoCart versions up to 2.4.0 contain an authentication‑bypass flaw in the admin password reset controller that lets an unauthenticated attacker send a HTTP GET request with a missing or incorrect code parameter. The flaw triggers a write to the configuration that sets the config_password value to 0, thereby disabling self‑service password recovery for all users. This change is permanent until an administrator manually restores the setting, effectively denying users the ability to reset lost passwords and potentially causing a denial of service to legitimate account holders.

The affected product is NivoCart, as handled by the vendor NIVOCART. All releases of the platform through version 2.4.0 are vulnerable; none of the later versions received a confirmed fix yet. Administrators who operate sites under guidance of NIVOCART must verify which release they run.

The vulnerability has a CVSS score of 6.9, indicating a medium severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, although public evidence shows that the problematic code is exposed in the repository. Attackers require no authentication and only need to construct a malicious request to the password reset endpoint, making the exploit trivial in a privileged network. The readability of the source code and the existence of the commit that demonstrates the issue suggests a high likelihood of exploitation in environments that have not applied a patch or mitigated the exposed endpoint.