Is CVE-2026-115453 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115453 being exploited in the wild.

How severe is CVE-2026-115453?

Informational severity, published 22 October 2026.

Which products and versions are affected?

MarcosCamara01 Ecommerce Template from commit b139a11c (24 December 2025) through commit 5b150c2 (before 27 July 2026).

How is CVE-2026-115453 attacked?

It is attacked over the network.

Am I affected by CVE-2026-115453?

Check whether you run MarcosCamara01 Ecommerce Template at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115453: MarcosCamara01 Ecommerce Template authorization bypass in cart and wishlist

CVE-2026-115453 · Severity: info · Published 2026-10-22

MarcosCamara01 Ecommerce Template is a storefront platform that manages shopping carts and wishlists for customers. An authenticated attacker can delete or modify the cart and wishlist items of any other user on the same installation, allowing them to sabotage competitors' shopping sessions and enumerate other users' preferences. The vulnerability stems from the application relying on PostgreSQL row-level security that is never actually enforced.

Technologies: MarcosCamara01 Ecommerce Template. Vendors: MarcosCamara01.

Quick answers

Is CVE-2026-115453 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115453 being exploited in the wild.
How severe is CVE-2026-115453?: Informational severity, published 22 October 2026.
Which products and versions are affected?: MarcosCamara01 Ecommerce Template from commit b139a11c (24 December 2025) through commit 5b150c2 (before 27 July 2026).
Is there a fix for CVE-2026-115453?: Yes: fixed in commit adf7dedb (27 July 2026). Until then: Run the application as a database role that does not own the cart_items and wishlist tables, or apply ALTER TABLE ... FORCE ROW LEVEL SECURITY to those tables manually. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115453 attacked?: It is attacked over the network.
Am I affected by CVE-2026-115453?: Check whether you run MarcosCamara01 Ecommerce Template at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: commit adf7dedb (27 July 2026)

Run the application as a database role that does not own the cart_items and wishlist tables, or apply ALTER TABLE ... FORCE ROW LEVEL SECURITY to those tables manually.

Technical details

An authorization bypass (CWE-639) exists in three database repository functions—cartRepository.delete(), cartRepository.updateQuantityInternal(), and wishlistRepository.delete()—that match rows by primary key alone without filtering by owning user. The application relies on PostgreSQL row-level security to enforce per-user authorization via set_config('app.current_user_id'), but the migrations only ENABLE row-level security, never FORCE it; PostgreSQL does not apply policies to the table owner, and the application connects as the owner using the same DATABASE_URL role that created the tables. Sequential bigserial IDs allow enumeration of other users' cart and wishlist rows. The fix adds explicit user_id filtering to the three vulnerable queries and applies FORCE ROW LEVEL SECURITY to the relevant tables.

Affected products

MarcosCamara01 Ecommerce Template from commit b139a11c (24 December 2025) through commit 5b150c2 (before 27 July 2026)

Timeline

2026-10-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.