critical

CVE-2026-112241

SureCart through 4.9.5 accepts a spoofed identity on its authentication path, so an anonymous request can act as another account - a store takeover with no credential

Severity: critical
Affected product: surecart
Affected versions: surecart < 4.9.6
Fixed in: surecart 4.9.6
Detection basis: Component version range
Shipped rule: surecart: SureCart through 4.9.5 accepts a spoofed identity on its authentication path, so an anonymous request can act as another account - a store takeover with no credential
Added to NewScan: 2026-10-22
Detected by: NewScan — free, self-hosted

How NewScan reports it

COMPONENT VERSION RANGE

NewScan fingerprints surecart from its response and reports this CVE when the detected version falls inside the affected range below.

References

NVD — CVE-2026-112241 ↗
CVE Record ↗

Scan for this yourself — local, in-band scanning is free.

Get NewScan (FREE) →

Review the measured benchmark, then use the verified remediation process.