---
id: CVE-2026-111277
title: >-
  NivoCart through 2.5.1 Guest Order Invoice Disclosure via
  account/order/download
summary: >-
  NivoCart through 2.5.1 contains a missing authorization vulnerability in the
  download() action of account/order that allows unauthenticated attackers to
  retrieve guest order invoices by supplying an order_id. Attackers can iterate
  the or…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: nivocart
product: nivocart
affected:
  - nivocart <= 2.5.1
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:43:22.473Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111277'
references:
  - url: 'https://github.com/nivocart/nivocart/issues/26'
    label: 'GitHub Issue #26'
  - url: >-
      https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/controller/account/order.php#L695-L770
  - url: >-
      https://github.com/nivocart/nivocart/blob/5bc2c3fc7caed9846b58959183f8ccf599cd4399/upload/catalog/model/account/order.php#L11-L12
  - url: 'https://github.com/nivocart/nivocart'
  - url: >-
      https://www.vulncheck.com/advisories/nivocart-through-2.5.1-guest-order-invoice-disclosure-via-account-order-download
    label: >-
      VulnCheck Advisory: NivoCart through 2.5.1 Guest Order Invoice Disclosure
      via account/order/download
tags:
  - cve.org
ingestedAt: '2026-10-15T22:48:25.448Z'
---

## Overview

NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.

## Affected

- `nivocart <= 2.5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.