{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115450",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T18:47:03.842052Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T18:47:42.157Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:marcoscamara01:ecommerce-template:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Ecommerce Template",
          "programFiles": [
            "src/app/api/user/cart/route.ts",
            "src/app/api/stripe/payment/route.ts"
          ],
          "repo": "https://github.com/MarcosCamara01/ecommerce-template",
          "vendor": "MarcosCamara01",
          "versions": [
            {
              "lessThan": "e6b364cd668f2ba875cfa7f6d55c63e771715df7",
              "status": "affected",
              "version": "2aa8ec539b6b441632096ced78e099fb096a57da",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dar\u00edo Rivas"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Gerard Martinez Guillamon"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Cristian Fern\u00e1ndez Cornejo"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Xo\u00e1n M. Otero Jorge"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Secur0 CNA"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "MarcosCamara01"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because \u003ccode\u003ePOST /api/user/cart\u003c/code\u003e accepts \u003ccode\u003evariantId\u003c/code\u003e, which determines what the order records, and \u003ccode\u003estripeId\u003c/code\u003e, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the \u003ccode\u003estripeId\u003c/code\u003e to be the one that belongs to the \u003ccode\u003evariantId\u003c/code\u003e. \u003ccode\u003ePOST /api/stripe/payment\u003c/code\u003e builds the Stripe Checkout line items from the stored value, as \u003ccode\u003e{ price: item.stripeId, quantity }\u003c/code\u003e, so the amount charged is the amount of that Stripe price. The \u003ccode\u003echeckout.session.completed\u003c/code\u003e webhook then creates the order products from the \u003ccode\u003evariantId\u003c/code\u003e of the same cart row, so the order records a product that was not paid for. Every \u003ccode\u003estripeId\u003c/code\u003e in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list."
            }
          ],
          "value": "External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-472",
              "description": "CWE-472 External Control of Assumed-Immutable Web Parameter",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T11:09:07.323Z",
        "orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
        "shortName": "Secur0"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MarcosCamara01/ecommerce-template/commit/e6b364cd668f2ba875cfa7f6d55c63e771715df7"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://secur0.com/en/cna/cve-list/cve-2026-115450-price-manipulation-stripe-checkout"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to a revision of the repository that includes commit \u003ccode\u003ee6b364cd668f2ba875cfa7f6d55c63e771715df7\u003c/code\u003e of 31 July 2026. The repository publishes no versioned releases and carries no git tags, so the fix can only be identified by commit."
            }
          ],
          "value": "Update to a revision of the repository that includes commit e6b364cd668f2ba875cfa7f6d55c63e771715df7 of 31 July 2026. The repository publishes no versioned releases and carries no git tags, so the fix can only be identified by commit."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
    "assignerShortName": "Secur0",
    "cveId": "CVE-2026-115450",
    "datePublished": "2026-10-22T15:13:37.089Z",
    "dateReserved": "2026-10-22T14:46:31.556Z",
    "dateUpdated": "2026-10-30T18:47:42.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}