# CVE-2026-111277: NivoCart missing authorization in order download

Source: https://junglewise.ai/threats/cve-2026-111277-nivocart-through-2-5-1-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111277 · Severity: high · CVSS 7.5 · Published 2026-10-15

NivoCart is an e-commerce platform used to build online stores. An unauthenticated attacker can download guest order invoices and access sensitive customer data including names, addresses, phone numbers, emails, and purchase history by exploiting a missing authorization check in the order download feature.

Technologies: [NivoCart](https://junglewise.ai/threats/technologies/nivocart). Vendors: [NivoCart](https://junglewise.ai/threats/vendors/nivocart).

## Quick answers

**Is CVE-2026-111277 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111277 being exploited in the wild.

**How severe is CVE-2026-111277?** High severity, with a CVSS score of 7.5, published 15 October 2026.

**Which products and versions are affected?** NivoCart through 2.5.1.

**Is there a fix for CVE-2026-111277?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111277 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111277?** Check whether you run NivoCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The download() action in the account/order controller lacks authorization checks, allowing unauthenticated users to retrieve invoices by iterating order_id parameters that correspond to guest orders (customer_id 0). By enumerating order IDs, an attacker can retrieve all guest order data without any authentication or user interaction required.

## Affected products

- NivoCart NivoCart through 2.5.1

## Timeline

- 2026-10-15: disclosed

## References

- [https://github.com/nivocart/nivocart](https://github.com/nivocart/nivocart)
- [https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/account/order.php](https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/account/order.php)

## Related threats

- [NivoCart CAPTCHA bypass in contact form](https://junglewise.ai/threats/cve-2026-111278-nivocart-through-2-5-1-contains-a-captcha-bypass-vulnerability)
- [NivoCart password reset token prediction in forgotten.php](https://junglewise.ai/threats/cve-2026-94107-nivocart-through-2-4-0-contains-a-predictable-password-reset)
- [NivoCart admin password reset configuration write](https://junglewise.ai/threats/cve-2026-94105-nivocart-through-2-4-0-contains-a-destructive-configuration-write)
- [NivoCart arbitrary file upload in File Manager](https://junglewise.ai/threats/cve-2026-94104-nivocart-through-2-4-0-contains-an-arbitrary-file-upload)