CVE-2026-52217

Cross-tenant and cross-user authorization flaw (IDOR / BOLA) in the VTEX Commerce Platform Checkout service.

Coordinated disclosure notice

Full technical detail and the proof of concept are not published in this repository while the researcher and VTEX complete coordinated disclosure under VTEX's published security policy. They are available to the vendor, and to the assigning CNA or MITRE for validation, on request through the private channel below. The full write-up will be published after a mutually agreed disclosure window.

• VTEX security channel: [email protected]
• VTEX disclosure policy: https://www.vtex.com/.well-known/security-disclosure-policy.txt
• VTEX security.txt: https://www.vtex.com/.well-known/security.txt

Summary

The Checkout OrderForm object is addressed by an orderFormId, but it is not bound to the VTEX account (tenant) or to the authenticated user that owns it. Because of that, a request presenting a valid orderFormId can read and modify that OrderForm across account and user boundaries, with no ownership check on the session.

Impact

An actor who obtains a victim's orderFormId can:

• Read the victim's checkout PII: name, e-mail, government document (CPF / CNPJ), phone, and shipping address.
• Overwrite checkout data such as the shipping and profile attachments, which allows redirecting the delivery of a paid order.
• Do the above across tenant boundaries and between different users of the same store.

The orderFormId is a 128-bit opaque token and is not enumerable, so this is an authorization flaw gated by obtaining a valid identifier, not a brute-force issue.

Remediation

Bind each OrderForm to its owning tenant and, for authenticated carts, to its owning user. Reject any read or write from a session whose tenant or user does not match the OrderForm owner, and reject anonymous access to an OrderForm owned by an authenticated user.

Validation (assigning CNA / MITRE)

Complete reproduction steps and a working proof of concept are available on request through the vendor channel above. The proof of concept was executed only against test accounts owned by the researcher, using synthetic data. Keeping it out of the public record preserves coordinated disclosure while the issue is being addressed.

Timeline

• 2026-05-11: CVE ID requested through MITRE; CVE-2026-52217 reserved.
• 2026-07-09: Public advisory reduced to this coordinated-disclosure reference at the vendor's request; coordination with VTEX in progress.

Credit

Theo Cia, Guardsi.