Authentication Bypass by Spoofing in express-cart

HIGH 8.8CVE-2018-16483 · GHSA-wj36-v8j4-pc7c · Published 01/02/2019 · updated 17/06/2026

In short

CVE-2018-16483 is a HIGH (CVSS 8.8) vulnerability affecting express-cart (express-cart project), express-cart.
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.1% of all vulnerabilities.
Fix: update to 1.1.6 or later.

Package	Affected versions	Patched versions
express-cart express-cart_project	`≤ 1.1.5`	No fix yet
express-cart npm	`< 1.1.6`	`1.1.6`

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

NVD description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≤ 1.1.5

No fix yet

npm

< 1.1.6

1.1.6

Description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

NVD description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

More vulnerabilities in express-cart

See all →