Read the docs
TI-2026-83022 Aliases CVE-2026-119558GHSA-qhj7-vg24-mhw4

OpenCart Payment Bypass via Free Checkout Reward Points

Priority LOW 11CWE-841Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

OpenCart through 4.1.0.4 lets logged-in customers place unpaid full-price orders because the checkout workflow does not enforce payment. After selecting Free Checkout, a customer can clear reward points and submit the order, so the confirm handler advances it to Free Checkout status without payment (CWE-841). An authenticated customer with low privileges can exploit this remotely with high attack complexity.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00201 10th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenCartOpenCartup to 4.1.0.4—No fix listedCNA
  • OpenCart VendorOpenCart Affected up to 4.1.0.4 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:opencart:opencart:*:*:*:*:*:*:*:*——OpenCart
  • cpe:2.3:a:opencart:opencart:*:*:*:*:*:*:*:* Versions — — ·OpenCart

Remediation

The sources list no fixed version for OpenCart.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119558
  2. 2026-10-30 Alias added: GHSA-qhj7-vg24-mhw4
  3. 2026-11-04 CISA SSVC decision points changed

References

Advisory 1

Other 3

  • TI-2023-21572 OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page… CVSS 3.1CRITICAL 9.8
  • TI-2021-22536 OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie CVSS 4.0CRITICAL 9.3
  • TI-2024-38428 OpenCart Core 4.0.2.3 SQL Injection via search Parameter CVSS 4.0HIGH 8.8
  • TI-2023-25651 An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users… CVSS 3.1HIGH 8.8
  • TI-2023-02171 Improper input validation in Opencart CVSS 3.1HIGH 8.8
  • TI-2021-22559 OpenCart 3.0.3.6 Account Takeover via Cross Site Request Forgery CVSS 4.0MEDIUM 6.9
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences