CVE-2026-94105 nivocart CVE debrief

Who should care

Defenders responsible for NivoCart deployments, especially those relying on password recovery features, should assess exposure and prioritize verification and potential mitigation.

Why it matters

CVE-2026-94105 is a medium-severity vulnerability in NivoCart that allows unauthenticated attackers to disable password recovery. Defenders should verify inventory, assess exposure, and consider implementing compensating controls or restricting access to the affected feature.

• Disruption of self-service password recovery functionality.
• Potential increase in administrative workload for password resets.
• Possible impact on user experience due to disabled password recovery.

Technical summary

The vulnerability exists in the admin password reset controller of NivoCart through version 2.4.0. By sending a GET request with a missing or incorrect code parameter, an unauthenticated attacker can rewrite the config_password setting to 0, effectively disabling self-service password recovery. This requires manual re-enablement by an administrator. The issue impacts defenders responsible for NivoCart deployments, especially those relying on password recovery features, as they must assess exposure and prioritize verification and potential mitigation.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory and assess exposure, especially in contexts where password recovery features are critical.

Recommended defensive actions

• Verify the presence of NivoCart version 2.4.0 or earlier in your inventory.
• Assess exposure, especially in contexts where password recovery features are critical.
• Implement compensating controls to monitor and restrict access to the admin password reset controller.
• Consider disabling self-service password recovery if not essential, or restrict access to the feature until a patch is applied.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the corpus does not establish versions beyond 2.4.0, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.