EUVD-2026-108213

Authorization Bypass Through User-Controlled Key CWE-639 in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete, cartRepository.updateQuantityInternal...

CVE-2026-115453

Authorization Bypass Through User-Controlled Key CWE-639 in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete, cartRepository.updateQuantityInternal...

CVE-2026-115453 Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries

Authorization Bypass Through User-Controlled Key CWE-639 in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete, cartRepository.updateQuantityInternal...

CVE-2026-115453

The MarcosCamara01 Ecommerce Template is vulnerable to an Authorization Bypass Through User-Controlled Key (CWE-639) . The cartRepository.delete(), cartRepository.updateQuantityInternal(), and wishlistRepository.delete() functions in src/lib/db/drizzle/repositories/ identify rows using only prima...