CVE-2026-94105 Details

A vulnerability exists in NivoCart versions through 2.4.0, allowing unauthenticated attackers to permanently disable password recovery. This is achieved by sending a GET request to the admin password reset controller with an invalid or missing code parameter. The vulnerability arises because the controller updates the configuration setting for password recovery to 0, effectively disabling the feature until an administrator manually re-enables it. The issue is located in the 'upload/admin/controller/common/reset.php' file, specifically between lines 93 and 96.

Remove the logic that updates the 'config_password' setting from the failure branch of the password reset code validation. Instead, invalid or missing codes should simply return an error message or redirect to the login page without altering the system configuration.