Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier
Summary
| CVE | CVE-2026-115450 |
|---|---|
| State | PUBLISHED |
| Assigner | Secur0 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-22 16:17:35 UTC |
| Updated | 2026-10-22 17:40:46 UTC |
| Description | External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts variantId, which determines what the order records, and stripeId, which determines what Stripe charges, as two independent fields of the request body, stores both on the cart row, and no check requires the stripeId to be the one that belongs to the variantId. POST /api/stripe/payment builds the Stripe Checkout line items from the stored value, as { price: item.stripeId, quantity }, so the amount charged is the amount of that Stripe price. The checkout.session.completed webhook then creates the order products from the variantId of the same cart row, so the order records a product that was not paid for. Every stripeId in the catalogue is readable by any visitor, so no value has to be guessed. This results in orders for goods at the price of the cheapest item in the catalogue, repeatable without limit, and in order records whose amount does not correspond to the product they list. |
Risk And Classification
Primary CVSS: v4.0 7.1 HIGH from 4daa8cea-433a-44bd-9456-53b127fc289a
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-472 | CWE-472 CWE-472 External Control of Assumed-Immutable Web Parameter
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 4daa8cea-433a-44bd-9456-53b127fc289a | Secondary | 7.1 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 7.1 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | MarcosCamara01 | Ecommerce Template | affected 2aa8ec539b6b441632096ced78e099fb096a57da e6b364cd668f2ba875cfa7f6d55c63e771715df7 git | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| secur0.com/en/cna/cve-list/cve-2026-115450-price-manipulation-stripe-che... | 4daa8cea-433a-44bd-9456-53b127fc289a | secur0.com | |
| github.com/MarcosCamara01/ecommerce-template/commit/e6b364cd668f2ba875cf... | 4daa8cea-433a-44bd-9456-53b127fc289a | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Darío Rivas (en)
CNA: Gerard Martinez Guillamon (en)
CNA: Cristian Fernández Cornejo (en)
CNA: Xoán M. Otero Jorge (en)
CNA: Secur0 CNA (en)
CNA: MarcosCamara01 (en)
Additional Advisory Data
Solutions
CNA: Update to a revision of the repository that includes commit e6b364cd668f2ba875cfa7f6d55c63e771715df7 of 31 July 2026. The repository publishes no versioned releases and carries no git tags, so the fix can only be identified by commit.