CVE-2026-117605 | nopSolutions nopCommerce up to 4.x ProductController ProductId improper authorization

October 28, 2026 Yanac

A vulnerability was found in nopSolutions nopCommerce up to 4.x and classified as problematic. This issue affects the function ProductController.RelatedProductAddPopup/CrossSellProductAddPopup/AssociatedProductAddPopup of the component ProductController. The manipulation of the argument ProductId results in improper authorization.

This vulnerability is reported as CVE-2026-117605. The attack can be launched remotely. No exploit exists.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More