CVE-2026-2165: Detronetdip E-commerce 1.0.0 Missing Authentication in Account Creation

Overview

CVE-2026-2165 affects an account creation endpoint in the administrative area of Detronetdip E-commerce 1.0.0. The weakness is classified as CWE-306 (Missing Authentication for Critical Function). The record states the function can be reached remotely, and the project was informed through an issue report without a response so far.

Impact

• NVD's CVSS 3.1 vector rates confidentiality, integrity and availability impacts as High, with no privileges or user interaction required.
• A missing authentication check on account creation could allow an unauthenticated remote party to create accounts. The record does not confirm which privileges such accounts would receive, so the scope of the impact is an inference.

Affected products and versions

• Product: Detronetdip E-commerce, version 1.0.0 as listed in the record.
• Component: account creation endpoint located at /Admin/assets/backend/seller/add_seller.php.
• The record lists no other affected versions and no fixed version. The absence of a fixed version does not mean no fix exists; it means none is documented in the sources consulted.

Exploitation status

• The record states that an exploit has been made available to the public. Public availability is not the same as confirmed exploitation in the wild.
• The record shows the vulnerability is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted.
• The EPSS probability is 0.00642 (about 0.64 percent) with a percentile of 0.49404.

Remediation and mitigation

• No vendor patch or fixed version is identified in the record. The only listed mitigation reference is the project issue #23.
• Restrict access to the administrative area to trusted networks and confirm that account creation requires authentication at both the web server and application layers.
• Review existing accounts, especially recently created seller or administrator accounts, for entries that were not expected.
• If the application is not essential, remove it from internet exposure until a fix is confirmed.
• Monitor the project repository for updates.

Detection guidance

• Review web server and application logs for requests to administrative paths under the affected directory that come from unexpected sources, particularly account creation requests without a prior authenticated session.
• Audit user tables for new seller or administrator accounts whose creation times do not match known onboarding activity.
• Raise alerts when account creation succeeds from external addresses.

Limitations of the available information

• The record provides no fixed version, no vendor advisory, and no detail on the privileges granted to created accounts.
• The record includes differing CVSS scores from the CNA (VulDB) at versions 4.0, 3.1 and 2.0, alongside the NVD score of 3.1. The NVD score is cited here.
• The record's title was null; the title in this analysis was written by the analyst.
• The EPSS date in the record (2026-10-13) is later than the published date (2026-02-08) and should be verified before relying on it.

Frequently asked questions

What is CVE-2026-2165?

It is a missing authentication weakness (CWE-306) in an account creation endpoint of Detronetdip E-commerce 1.0.0, as described in the record.

Is this vulnerability being actively exploited?

The record says a public exploit is available, but it does not list the flaw in CISA KEV and no confirmed active exploitation appears in the sources consulted.

Is there a fixed version?

No fixed version is identified in the record. The only listed mitigation reference is the project issue, and the vendor has not responded according to the record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.