Is CVE-2026-91154 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91154 being exploited in the wild.

How severe is CVE-2026-91154?

Informational severity, published 28 September 2026.

Which products and versions are affected?

MarcosCamara01 Ecommerce Template before commit ec97209.

Is there a fix for CVE-2026-91154?

A patch was published on 2026-09-08: Fix merged in commit ec97209 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91154 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-91154?

Check whether you run MarcosCamara01 Ecommerce Template at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91154: Ecommerce Template missing authentication in cache revalidation

CVE-2026-91154 · Severity: info · Published 2026-09-28

The Ecommerce Template contains an unauthenticated Server Action that can clear the product cache without any permission checks. An attacker can repeatedly invoke this action from the public internet to permanently degrade storefront performance by forcing all product requests to read from the database instead of serving cached data. This denial-of-service attack costs attackers almost nothing but can severely impact site availability and user experience.

Technologies: MarcosCamara01 Ecommerce Template. Vendors: MarcosCamara01.

Quick answers

Is CVE-2026-91154 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91154 being exploited in the wild.
How severe is CVE-2026-91154?: Informational severity, published 28 September 2026.
Which products and versions are affected?: MarcosCamara01 Ecommerce Template before commit ec97209.
Is there a fix for CVE-2026-91154?: A patch was published on 2026-09-08: Fix merged in commit ec97209 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91154 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-91154?: Check whether you run MarcosCamara01 Ecommerce Template at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A file-scoped "use server" module exports revalidateProducts() without authentication, allowing any unauthenticated user to invoke the function as a POST Server Action. The function calls updateTag("products") to invalidate cache entries, but includes no session or role check. Client components import the function, causing its Server Action ID to compile into a public static bundle that the admin middleware does not gate. Repeated unauthenticated invocation forces all storefront pages to recompute from the database, creating a persistent denial of service.

Affected products

MarcosCamara01 Ecommerce Template before commit ec97209

Timeline

2026-09-28: disclosed: Public disclosure on NVD
2026-09-08: patched: Fix merged in commit ec97209

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.