{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nivocart--2.5.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nivocart:nivocart:*:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NivoCart (\u003c= 2.5.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["NivoCart"],"content_html":"\u003cp\u003eNivoCart versions up to and including 2.5.1 contain a significant authorization vulnerability within the \u003ccode\u003edownload()\u003c/code\u003e action of the \u003ccode\u003eaccount/order\u003c/code\u003e module. This flaw stems from a failure to verify the requester's identity or permissions before processing invoice retrieval requests. An unauthenticated attacker can exploit this by sending crafted HTTP requests to the application, specifically targeting the \u003ccode\u003eorder_id\u003c/code\u003e parameter. Because the application fails to restrict access to records where the \u003ccode\u003ecustomer_id\u003c/code\u003e is set to 0 (the identifier used for guest checkouts), an attacker can systematically enumerate these IDs to scrape private customer data. This vulnerability poses a high risk to data privacy, as it permits unauthorized access to names, physical addresses, telephone numbers, email addresses, and granular purchase history.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to mass exfiltration of customer PII and sensitive purchase information. The ability to enumerate guest orders allows an attacker to build comprehensive lists of customer profiles and transaction records. This breach of confidentiality impacts individual user privacy and may result in regulatory non-compliance for organizations hosting vulnerable NivoCart instances.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch immediately by upgrading NivoCart to a version beyond 2.5.1 as soon as a security update is released by the vendor.\u003c/li\u003e\n\u003cli\u003eImplement an application-level web access control list or WAF rule to block suspicious patterns of sequential \u003ccode\u003eorder_id\u003c/code\u003e requests originating from a single IP address.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for high-frequency requests to \u003ccode\u003e/account/order/download\u003c/code\u003e or equivalent endpoints featuring incrementing \u003ccode\u003eorder_id\u003c/code\u003e integer values.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-15T22:49:41Z","date_published":"2026-10-15T22:49:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nivocart-auth-bypass/","summary":"NivoCart through 2.5.1 contains a missing authorization vulnerability in the account/order module that allows unauthenticated attackers to exfiltrate guest order invoices by iterating order identifiers.","title":"NivoCart Unauthorized Invoice Disclosure Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-10-nivocart-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - NivoCart (\u003c= 2.5.1)","version":"https://jsonfeed.org/version/1.1"}