CVE-2026-96599: Isotope eCommerce Information Disclosure

CVE-2026-96599 Overview

CVE-2026-96599 is a weak randomness vulnerability [CWE-330] in Isotope eCommerce versions through 2.9.10. The extension generates order identifiers using PHP's uniqid() function instead of a cryptographically secure random source. Unauthenticated attackers can predict or guess these identifiers by supplying a crafted uid parameter. Because guest orders do not enforce ownership verification, attackers can retrieve order details belonging to other customers. Exposed data includes billing addresses, customer contact information, and links to purchased digital files.

Critical Impact
Unauthenticated attackers can enumerate guest order identifiers to access billing details, customer information, and purchased files from any Isotope eCommerce storefront running versions through 2.9.10.

Affected Products

Isotope eCommerce (Contao extension) versions through 2.9.10
isotope/core package distributed via the Isotope GitHub repository
Contao CMS deployments bundling vulnerable Isotope releases

Discovery Timeline

2026-09-23 - CVE-2026-96599 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96599

Vulnerability Analysis

The vulnerability arises from two compounded design flaws in Isotope eCommerce order handling. First, order identifiers are derived from PHP's uniqid() function, which returns a value based on the current microsecond timestamp. Second, the OrderDetails module exposes guest order data via a uid query parameter without verifying that the requester owns the order. Attackers can iterate through predictable identifier ranges and retrieve arbitrary order records over the network. The disclosed data includes personally identifiable information (PII) and, for digital storefronts, direct access to purchased file downloads. See the VulnCheck Advisory on Isotope for a full technical writeup.

Root Cause

The root cause is insecure use of a non-cryptographic randomness primitive [CWE-330]. uniqid() is documented as unsuitable for security purposes because its output is derived from the system clock and is trivially predictable. The identifier generation logic lives in system/modules/isotope/library/Isotope/Model/ProductCollection/Order.php. Combined with the missing authorization check in OrderDetails.php, the weak identifier becomes the sole access control gate for sensitive order records.

Attack Vector

An unauthenticated remote attacker crafts HTTP requests to the storefront's order details endpoint, supplying guessed uid values. Because uniqid() output tracks the microsecond clock at order creation, attackers can narrow candidate values by observing timing patterns or by brute-forcing constrained ranges. Successful requests return complete order pages containing billing addresses, contact data, and download links. See the Isotope Order.php Code Snippet and the Isotope OrderDetails.php Code Snippet for the affected code paths.

Detection Methods for CVE-2026-96599

Indicators of Compromise

High volumes of HTTP GET requests to Isotope order detail routes with varying uid parameter values from a single source IP.
Sequential or timestamp-clustered uid values appearing in web server access logs within short time windows.
Anomalous 200 OK responses for order detail pages served to unauthenticated sessions.
Outbound access to purchased-file download URLs referenced from previously unaccessed order records.

Detection Strategies

Baseline normal order lookup traffic per client and alert on burst rates exceeding legitimate customer behavior.
Correlate uid parameter entropy across requests to identify enumeration patterns.
Flag requests where the referring session has no prior checkout activity yet accesses order detail pages.

Monitoring Recommendations

Enable verbose web access logging on all Contao and Isotope endpoints, retaining full query strings.
Forward web and application logs to a centralized analytics platform for correlation and long-term retention.
Alert on any authenticated administrator account querying bulk order records outside scheduled reporting windows.

How to Mitigate CVE-2026-96599

Immediate Actions Required

Restrict public access to Isotope order detail routes behind authentication or IP allowlisting until a patched release is deployed.
Rotate any exposed customer data workflows and notify affected customers if enumeration activity is confirmed in logs.
Review recent web access logs for uid parameter enumeration attempts against OrderDetails endpoints.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Monitor the Isotope Core Repository and Isotope Core Issue #2585 for remediation status. Upgrade to a release that replaces uniqid() with a cryptographically secure identifier source such as random_bytes() and enforces ownership verification on guest order retrieval.

Workarounds

Deploy a web application firewall (WAF) rule that rate-limits and blocks enumeration patterns on order detail endpoints.
Require session-bound tokens or email-verification links for guest order access instead of relying on the uid parameter alone.
Regenerate identifiers for existing guest orders using a cryptographically secure random source where feasible.
Disable guest checkout temporarily and require authenticated accounts for order retrieval.

bash

# Example WAF rule concept (ModSecurity-style) to throttle uid enumeration
SecRule REQUEST_URI "@contains /order/details" \
  "id:1009901,phase:1,pass,nolog,\
   setvar:ip.uid_requests=+1,expirevar:ip.uid_requests=60"
SecRule IP:UID_REQUESTS "@gt 20" \
  "id:1009902,phase:1,deny,status:429,\
   msg:'Possible Isotope order uid enumeration (CVE-2026-96599)'"