CVE-2026-90896 Details

A vulnerability exists in the Ecommerce Template's Stripe checkout session lookup endpoint, specifically in versions prior to commit 91e273c. This vulnerability allows remote, unauthenticated attackers to access sensitive buyer information by exploiting the lack of authentication and ownership checks in the checkout session retrieval process. The endpoint inadvertently exposes personal data such as the buyer's name, email, phone number, billing address, amount paid, and internal user ID. The issue arises because the GET handler retrieves the full checkout session object from Stripe without verifying the authenticity of the request or the ownership of the session. This flaw is particularly concerning as the session ID, required for exploitation, is leaked through the buyer's URL after payment, potentially disclosing personal information to unauthorized parties via Referer headers, analytics tools, server logs, and shared browser history.

Users should upgrade to a version that includes commit 91e273c, which is available on the master branch of the Ecommerce Template repository. The fix implements necessary authentication and ownership checks before returning checkout session data.