CVE-2026-94105: NivoCart Auth Bypass Vulnerability

CVE-2026-94105 Overview

CVE-2026-94105 affects NivoCart through version 2.4.0. The vulnerability resides in the admin password reset controller (upload/admin/controller/common/reset.php), which writes configuration state before validating the supplied reset code. An unauthenticated attacker can send a GET request containing a missing or invalid code parameter to force the config_password setting to 0. This action disables self-service password recovery across the store until an administrator manually re-enables the feature. The flaw is categorized under CWE-754: Improper Check for Unusual or Exceptional Conditions.

Critical Impact
Remote, unauthenticated attackers can disable the NivoCart password recovery workflow, locking legitimate administrators out of the self-service reset path.

Affected Products

NivoCart through 2.4.0
upload/admin/controller/common/reset.php (lines 93-99)
upload/admin/model/user/user.php (lines 119-123)

Discovery Timeline

2026-09-20 - CVE-2026-94105 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94105

Vulnerability Analysis

The defect is a business logic and input validation flaw in the administrative password reset workflow. The reset controller processes a GET request that carries a code parameter used to verify the recovery request. Instead of validating the code before performing state changes, the controller invokes the user model to update the config_password setting first. When the code is missing or does not match, the reset flow aborts, but the destructive configuration write has already persisted. The result is a persistent denial-of-service condition against the password recovery feature that survives across sessions.

Root Cause

The root cause is improper ordering of validation and side effects in the reset controller. The handler calls the model method that writes config_password = 0 prior to comparing the supplied code against the expected value. See the reset controller source and the user model source for the affected code paths. No authentication or CSRF token check gates the endpoint.

Attack Vector

Exploitation requires only network access to the storefront's admin path. An attacker issues a single unauthenticated GET request to the reset endpoint with an absent or arbitrary code value. The application writes config_password to 0, which disables the self-service password recovery UI for all administrators. Recovery remains disabled until an administrator with direct database or file access manually restores the configuration flag. Further discussion is available in GitHub Issue #25 and the VulnCheck advisory.

No verified exploit code is published. The vulnerability is triggered by an
unauthenticated GET request to the admin reset controller with a missing
or incorrect `code` parameter, which causes the controller to persist
`config_password = 0` before validation completes.

Detection Methods for CVE-2026-94105

Indicators of Compromise

Unauthenticated GET requests to admin/index.php?route=common/reset or equivalent reset controller paths with absent or malformed code parameters.
Database or configuration audit entries showing config_password transitioned from 1 to 0 outside of an administrator-initiated change window.
Administrator reports that the storefront's "Forgotten Password" link no longer appears or fails to send recovery emails.

Detection Strategies

Correlate web server access logs for repeated requests to the reset controller lacking valid session cookies or referrers.
Alert on any write operation to the setting table that modifies config_password when the actor is not an authenticated administrator.
Baseline legitimate password reset flows and flag reset requests that do not produce a subsequent successful login or user record update.

Monitoring Recommendations

Ingest NivoCart admin access logs into a centralized log platform and retain them for at least 90 days to support investigation.
Monitor for outbound rate anomalies against the common/reset route from single source IPs, which may indicate automated abuse.
Track administrator help-desk tickets referencing lost password recovery access as a business signal that correlates with exploitation.

How to Mitigate CVE-2026-94105

Immediate Actions Required

Restrict access to the /admin/ path using IP allow-lists, a reverse proxy, or a Web Application Firewall (WAF) rule until a patched release is deployed.
Deploy a WAF signature that blocks GET requests to the reset controller when the code parameter is missing, empty, or fails a length and format check.
Verify the current value of config_password in the setting table and reset it to 1 if it was changed without administrator action.

Patch Information

As of the NVD publication date (2026-09-20), no fixed release of NivoCart has been referenced in the advisory. Monitor the NivoCart GitHub repository and the VulnCheck advisory for a patched version. A local hotfix should reorder the reset controller to validate the code parameter against the stored token before invoking the user model method that writes config_password.

Workarounds

Comment out or remove the destructive write in upload/admin/model/user/user.php (lines 119-123) so that config_password is only modified after successful code validation.
Add an authentication or CSRF token check in upload/admin/controller/common/reset.php (lines 93-99) to reject requests that omit or malform the code parameter.
Enforce network-layer restrictions on the admin directory using web server rules such as Require ip in Apache or an allow/deny block in nginx.

bash

# nginx example: restrict NivoCart admin path to trusted networks
location /admin/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}

# nginx example: block reset requests missing a code parameter
location ~ /admin/.*route=common/reset {
    if ($arg_code = "") { return 403; }
}