CVE-2026-115453: CWE-639 Authorization Bypass Through User-Controlled Key in MarcosCamara01 Ecommerce Template

The MarcosCamara01 Ecommerce Template suffers from an authorization bypass (CWE-639) in its cart and wishlist repositories. The vulnerability arises because the cartRepository.delete(), cartRepository.updateQuantityInternal(), and wishlistRepository.delete() functions match rows solely by primary key without verifying ownership. Although PostgreSQL row level security policies are defined to restrict access based on the current user ID, the application connects to the database using the table owner's role, which is exempt from these policies. Additionally, the absence of FORCE ROW LEVEL SECURITY means policies do not apply to the owner role. Sequential bigserial IDs allow attackers to enumerate other users' cart and wishlist items. Consequently, authenticated users can delete or modify cart and wishlist data belonging to other users within the same installation.

Authenticated users can bypass intended authorization controls to delete or modify cart and wishlist entries of other users. This compromises data integrity and privacy within the ecommerce application, potentially leading to user disruption and loss of trust. The vulnerability does not require elevated privileges beyond authentication but exploits misconfiguration of database security policies.

No official patch or fix is currently documented. Mitigation requires changing the database connection to avoid using the table owner role at runtime, ensuring that PostgreSQL row level security policies are enforced by using FORCE ROW LEVEL SECURITY on affected tables, and verifying that application queries include predicates restricting access to the current user's data. Review and update database roles and policies to prevent owner role bypass. Monitor vendor advisories for official fixes or updates.