Insufficient session expiration in nopSolutions nopCommerce
Priority MEDIUM 64CWE-613Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-613.
Summary
nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00442 38th percentileScored 2026-11-07
Fix Fixed nopCommerce (nopSolutions): 4.70
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nopSolutions | nopCommerce | 4.80.3 – 4.80.4 | — | No fix listed | CNA |
| nopSolutions | nopCommerce | 4.10 to before 4.70 | 4.70 | Patch available | CNA |
- nopCommerce VendornopSolutions Affected 4.80.3 – 4.80.4 Fixed in — No fix listed CNA
- nopCommerce VendornopSolutions Affected 4.10 to before 4.70 Fixed in 4.70 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nopcommerce:nopcommerce:*:*:*:*:*:*:*:* | before 4.70.0 | Vulnerable | nopCommerce |
| cpe:2.3:a:nopcommerce:nopcommerce:4.80.3:*:*:*:*:*:*:* | 4.80.3 | Vulnerable | nopCommerce |
- cpe:2.3:a:nopcommerce:nopcommerce:*:*:*:*:*:*:*:* Versions before 4.70.0 Vulnerable ·nopCommerce
- cpe:2.3:a:nopcommerce:nopcommerce:4.80.3:*:*:*:*:*:*:* Versions 4.80.3 Vulnerable ·nopCommerce
Remediation
- Fix · CNA nopCommerce (nopSolutions) Fixed in 4.70
Timeline
- 2026-10-02 Threatist record created from CVE-2025-11699
- 2026-10-03 Alias added: GHSA-hgx3-j7fm-pjm3
References
More nopSolutions vulnerabilities
- TI-2026-81650 Missing authorization in nopCommerce admin product popup handlers CVSS 4.0MEDIUM 5.3
Sources
- CVE-2025-11699 · CVE Program
- CVE-2025-11699 · NVD
- FIRST EPSS
- GHSA-hgx3-j7fm-pjm3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences