# mrvautin express-cart privilege escalation

Source: https://junglewise.ai/threats/mrvautin-express-cart-privilege-escalation-40469371  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-06-03. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2019-06-03

express-cart is an open-source e-commerce shopping cart platform. A security flaw allows any user to bypass access controls and create new administrator accounts. This could lead to a complete takeover of the online store, allowing unauthorized individuals to access customer data, modify orders, or disrupt business operations.

Technologies: [express-cart (npm)](https://junglewise.ai/threats/technologies/express-cart). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 3 June 2019.

**Which products and versions are affected?** express-cart (npm) SEMVER:introduced=0,fixed=1.1.6.

**Is there a fix for This vulnerability?** Yes. express-cart (npm): upgrade to 1.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run express-cart (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- express-cart (npm): upgrade to 1.1.6 or later

  ```sh
  npm install express-cart@1.1.6
  ```


## Technical details

A privilege escalation vulnerability exists in express-cart versions prior to 1.1.6 due to insufficient access control checks during user creation. An attacker can exploit this by sending a crafted request to the user registration or management endpoints, potentially by manipulating the referrer or other request parameters to bypass authorization logic. Successful exploitation allows a remote attacker to create a new user with administrative privileges. This results in a complete compromise of the application's integrity and confidentiality. The issue was addressed in version 1.1.6 by improving the validation of administrative user creation.

## Affected products

- mrvautin express-cart < 1.1.6

## Timeline

- 2018-07-12: disclosed: Vulnerability disclosed via HackerOne report 343626
- 2019-06-03: advisory: GitHub Advisory published
- 2026-02-03: other: Advisory withdrawn as a duplicate of GHSA-hr89-w7p6-pjmq

## References

- [https://github.com/mrvautin/expressCart/commit/baccaae9b0b72f00b10c5453ca00231340ad3e3b](https://github.com/mrvautin/expressCart/commit/baccaae9b0b72f00b10c5453ca00231340ad3e3b)
- [https://hackerone.com/reports/343626](https://hackerone.com/reports/343626)
- [https://github.com/nodejs/security-wg/blob/master/vuln/npm/469.json](https://github.com/nodejs/security-wg/blob/master/vuln/npm/469.json)
- [https://snyk.io/vuln/npm:express-cart:20180712](https://snyk.io/vuln/npm:express-cart:20180712)
- [https://www.npmjs.com/advisories/730](https://www.npmjs.com/advisories/730)

## Related threats

- [express-cart admin user creation auth bypass](https://junglewise.ai/threats/cve-2018-12457-express-cart-admin-user-creation-auth-bypass)
- [express-cart unrestricted file upload vulnerability](https://junglewise.ai/threats/cve-2018-3758-express-cart-unrestricted-file-upload-vulnerability)
- [express-cart Cross-Site Request Forgery in admin](https://junglewise.ai/threats/cve-2020-22403-express-cart-cross-site-request-forgery-in-admin)
- [express-cart cross-site scripting in admin](https://junglewise.ai/threats/express-cart-cross-site-scripting-in-admin-364784a1)
- [express-cart NoSQL injection in login](https://junglewise.ai/threats/express-cart-nosql-injection-in-login-f1d83a16)