CVE-2026-111277 Details

A missing authorization vulnerability has been identified in NivoCart versions through 2.5.1. The issue resides in the 'download()' action of the account/order controller, where unauthenticated attackers can access guest order invoices by providing an 'order_id'. This vulnerability allows for the disclosure of personal information such as guest names, addresses, telephone numbers, emails, purchased items, and order totals. The flaw arises because the 'download()' method lacks authentication checks, in contrast to other order-related actions that require user login.

To address this vulnerability, implement authentication checks in the 'download()' method of the account/order controller. The same authentication gates used in the 'info()' and 'picklist()' actions should be applied to ensure that only logged-in users can access the order invoice downloads.