CVE-2026-92810CWE-639

CVE-2026-92810

Medium · published September 17, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
26.5
In the wild
Unconfirmed
What it is

PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier. Attackers can supply sequential wishlist identifiers to obtain valid share links and read other customers' private wishlist contents.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00342 · 26.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-17T01:17Z
References (4)
https://github.com/PrestaShop/blockwishlist · [email protected]https://github.com/PrestaShop/blockwishlist/blob/v3.0.2/controllers/front/action.php#L411-L421 · [email protected]https://github.com/geo-chen/oss/blob/main/prestashop.md#finding-2-blockwishlist-idor-wishlist-share-token-disclosure-via-missing-authorization-check · [email protected]https://www.vulncheck.com/advisories/prestashop-blockwishlist-through-3.0.2-information-disclosure · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 20:32Z
    PrestaShop blockwishlist through 3.0.2 Information Disclosure
    cvelistv5