CVE-2026-92810

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92810
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92810.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92810
Published
2026-09-16T20:32:56Z
Modified
2026-09-19T03:30:50Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
PrestaShop blockwishlist through 3.0.2 Information Disclosure
Details

PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier. Attackers can supply sequential wishlist identifiers to obtain valid share links and read other customers' private wishlist contents.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92810.json"
}
References

Affected packages

Git / github.com/prestashop/blockwishlist

Affected ranges

Type
GIT
Repo
https://github.com/prestashop/blockwishlist
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
25fe641134ede5703397ae9a180694db18c8383a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.2"
        },
        {
            "fixed": "3.0.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.1
v2.1.0
v2.1.1
v2.1.2
v3.*
v3.0.0
v3.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92810.json"