CVE-2026-119558

OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://abraxaslabs.tech/research/opencart-reward-free-checkout
https://github.com/opencart/opencart
https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/checkout/reward.php#L89-L94
https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/payment/free_checkout.php#L47-L55
https://www.vulncheck.com/advisories/opencart-through-4.1.0.4-payment-bypass-via-free-checkout-reward-points

Configurations

No configuration.

History

30 Oct 2026, 12:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-30 12:16

Updated : 2026-10-30 19:14

NVD link : CVE-2026-119558

Mitre link : CVE-2026-119558

CVE.ORG link : CVE-2026-119558

JSON object : View

Products Affected

No product.

CWE

CWE-841

Improper Enforcement of Behavioral Workflow

{"id": "CVE-2026-119558", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/opencart/opencart", "vendor": "OpenCart", "product": "OpenCart", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.1.0.4"}], "packageURL": "pkg:github/opencart/opencart", "defaultStatus": "unaffected"}]}], "published": "2026-10-30T12:16:43.057", "references": [{"url": "https://abraxaslabs.tech/research/opencart-reward-free-checkout", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/opencart/opencart", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/checkout/reward.php#L89-L94", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/payment/free_checkout.php#L47-L55", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/opencart-through-4.1.0.4-payment-bypass-via-free-checkout-reward-points", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-841"}]}], "descriptions": [{"lang": "en", "value": "OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment."}], "lastModified": "2026-10-30T19:14:38.697", "sourceIdentifier": "disclosure@vulncheck.com"}