High 8.8 CVSS 3.1 totadministrativemandate Published on 2026-07-31

PrestaShop module, totadministrativemandate

CVECVE-2026-50986 GHSANo GHSA advisory

View at the source View JSON Last modified at the source: 2026-08-31

Description

PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · secondary

High 8.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vectorNetwork

ComplexityLow

Privileges requiredNone

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

References

Sourceaddons.prestashop.com
https://addons.prestashop.com/fr/paiement-transfert-bancaire/6297-mandat-administratif.html
Sourceprestafence.com
https://prestafence.com/en/2026/07/cve-2026-50986-csrf-administrative-mandate/

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: totadministrativemandate

All totadministrativemandate advisories (2)

IDAdvisoryComponentSeverityAffected versionsPublishedFix

CVE-2022-46965 PrestaShop module, totadministrativemandate before v1.7.1 was discovered to contain a SQL injection vulnerability. totadministrativemandate High 8.8 ≤ 1.7.1 2023-02-02 No

Do you use the totadministrativemandate module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.

Check if my shop is affected