id: CVE-2026-90896

info:
  name: "MarcosCamara01 Ecommerce Template - Unauthenticated Stripe Checkout Session Disclosure"
  author: vedas-arpsyndicate
  severity: high
  description: |
    MarcosCamara01 Ecommerce Template before commit 91e273c exposes GET
    /api/stripe/checkout_sessions, whose handler calls stripe.checkout.sessions.retrieve()
    with a caller-supplied session_id and returns the result with no access control, while
    sibling endpoints enforce auth via auth.api.getSession(). A remote unauthenticated
    attacker holding a valid Checkout Session id can retrieve the buyer's name, email, phone,
    billing address, amount paid and internal userId. The endpoint reaching Stripe for an
    arbitrary (even non-existent) session id without an auth gate confirms the exposure.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-90896&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=ecommerce-template&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 8.2
    cve-id: CVE-2026-90896
    cwe-id: CWE-306
  metadata:
    verified: false
  tags: cve,cve2026,ecommerce-template,stripe,exposure
http:
  - raw:
      - |
        GET /api/stripe/checkout_sessions?session_id=cs_test_{{randstr}} HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'status_code != 401 && status_code != 403 && status_code != 404'
          - 'contains(body, "No such checkout.session") || contains(body, "resource_missing")'
        condition: and