CVE-2026-91154: CWE-306 Missing Authentication for Critical Function in MarcosCamara01 Ecommerce Template
Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cache at will. The file declares "use server" at file scope, so every exported function compiles into a POST-invokable Server Action; revalidateProducts calls updateTag("products") with no session or role check, unlike the read-only actions in the same file which are safe by construction. Two client components under src/components/admin import the function, which causes its Server Action id to be compiled into a public /_next/static chunk that the application's admin middleware (proxy.ts) does not gate, so any unauthenticated user can extract that id from the public bundle and invoke the action directly. With cacheComponents enabled, the entire storefront (home, categories, product pages, search) is served from "use cache" entries produced by getAllProducts, getCategoryProducts and getProduct, all tagged products with an hours-long cacheLife. Repeated unauthenticated invocation of revalidateProducts keeps that cache permanently cold, forcing every visitor's request to read the full product catalog from Postgres instead of serving from cache, degrading storefront availability at near-zero attacker cost.
AI Analysis
Technical Summary
The MarcosCamara01 Ecommerce Template before commit ec97209 contains a missing authentication vulnerability (CWE-306) in the cache revalidation server action revalidateProducts (src/app/actions.ts). This function is compiled into a POST-invokable Server Action without any session or role verification. Two client admin components import this function, causing its Server Action ID to be included in a public static chunk that the admin middleware does not protect. Consequently, any unauthenticated user can extract this ID and invoke revalidateProducts directly. When cacheComponents is enabled, this action invalidates the entire storefront product cache, forcing all visitors to fetch product data from the database instead of cache, degrading storefront availability.
Potential Impact
An unauthenticated remote attacker can repeatedly invoke the revalidateProducts server action to force expiration of the entire product cache. This results in the storefront serving uncached product data, increasing database load and degrading availability for all users. The attack requires no privileges and can be performed at near-zero cost, potentially causing a denial of service through resource exhaustion.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the server action by implementing proper authentication and authorization checks on revalidateProducts. Additionally, ensure that the admin middleware properly gates access to server action IDs included in public bundles to prevent unauthenticated invocation.
CVE-2026-91154: CWE-306 Missing Authentication for Critical Function in MarcosCamara01 Ecommerce Template
Description
Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cache at will. The file declares "use server" at file scope, so every exported function compiles into a POST-invokable Server Action; revalidateProducts calls updateTag("products") with no session or role check, unlike the read-only actions in the same file which are safe by construction. Two client components under src/components/admin import the function, which causes its Server Action id to be compiled into a public /_next/static chunk that the application's admin middleware (proxy.ts) does not gate, so any unauthenticated user can extract that id from the public bundle and invoke the action directly. With cacheComponents enabled, the entire storefront (home, categories, product pages, search) is served from "use cache" entries produced by getAllProducts, getCategoryProducts and getProduct, all tagged products with an hours-long cacheLife. Repeated unauthenticated invocation of revalidateProducts keeps that cache permanently cold, forcing every visitor's request to read the full product catalog from Postgres instead of serving from cache, degrading storefront availability at near-zero attacker cost.
CVSS v4.0
Score 6.9medium
Affected software
MarcosCamara01
Ecommerce Template
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The MarcosCamara01 Ecommerce Template before commit ec97209 contains a missing authentication vulnerability (CWE-306) in the cache revalidation server action revalidateProducts (src/app/actions.ts). This function is compiled into a POST-invokable Server Action without any session or role verification. Two client admin components import this function, causing its Server Action ID to be included in a public static chunk that the admin middleware does not protect. Consequently, any unauthenticated user can extract this ID and invoke revalidateProducts directly. When cacheComponents is enabled, this action invalidates the entire storefront product cache, forcing all visitors to fetch product data from the database instead of cache, degrading storefront availability.
Potential Impact
An unauthenticated remote attacker can repeatedly invoke the revalidateProducts server action to force expiration of the entire product cache. This results in the storefront serving uncached product data, increasing database load and degrading availability for all users. The attack requires no privileges and can be performed at near-zero cost, potentially causing a denial of service through resource exhaustion.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the server action by implementing proper authentication and authorization checks on revalidateProducts. Additionally, ensure that the admin middleware properly gates access to server action IDs included in public bundles to prevent unauthenticated invocation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Secur0
- Date Reserved
- 2026-09-14T21:05:54.953Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aba8c4ff7a7c54106e0509e
Added to database: 09/28/2026, 15:48:31 UTC
Last enriched: 09/28/2026, 16:02:59 UTC
Last updated: 09/29/2026, 01:57:22 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.