Is there a patch available for CVE-2026-32270?

Yes, a patch is available for CVE-2026-32270. Update the affected software to the latest version immediately.

Craft Commerce CVE-2026-32270

Q: What is the CVSS score of CVE-2026-32270?

CVE-2026-32270 has a CVSS 4.0 base score of 1.7 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22073 LOW

Information Exposure (CWE-200)

2026-04-13 GitHub_M

GHSA-3vxg-x5f8-f5qf

Information Disclosure Commerce Craftcms

1.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

1.7 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

AC:H reflects the prerequisite of knowing a valid order number; PR:N because no authentication is required; C:L for partial PII disclosure with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 08:00 vuln.today

Analysis Generated

Jul 24, 2026 - 08:00 vuln.today

Patch released

Apr 14, 2026 - 02:30 nvd

Patch available

CVSS changed

Apr 13, 2026 - 20:22 NVD

1.7 (LOW)

EUVD ID Assigned

Apr 13, 2026 - 20:15 euvd

EUVD-2026-22073

CVE Published

Apr 13, 2026 - 20:08 nvd

LOW 1.7

DescriptionGitHub Advisory

Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, the PaymentsController::actionPay discloses some order data to unauthenticated users when an order number is provided and the email check fails during an anonymous payment. The JSON error response includes the serialized order object (order), which contains some sensitive fields such as customer email, shipping address, and billing address. The frontend payment flow's actionPay() retrieves orders by number before authorization is fully enforcedLoad order by number. This issue has been fixed in versions 4.11.0 and 5.6.0.

AnalysisAI

Unauthenticated information disclosure in Craft Commerce's PaymentsController exposes serialized order data - including customer email, shipping address, and billing address - when an anonymous payment attempt fails the email authorization check. Affected versions span 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4. No public exploit code exists and no active exploitation has been confirmed; the CVSS 4.0 score of 1.7 and EPSS of 0.05% (14th percentile) reflect the low real-world risk, though the data exposed (PII) is meaningful for affected customers.

Technical ContextAI

Craft Commerce is a PHP-based ecommerce plugin for the Craft CMS platform (cpe:2.3:a:craftcms:commerce:*:*:*:*:*:*:*:*). The vulnerable code path resides in PaymentsController::actionPay(), which handles the frontend anonymous payment flow. The controller loads a full order object by order number before completing authorization checks. When the subsequent email validation fails, the error branch previously included the serialized order via cartArray($order) in the JSON failure response - returning PII to the requestor even though access was denied. This is a classic CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) pattern: authorization enforcement is incomplete because the early data fetch is not gated, and the error response path reuses the already-loaded object without scrubbing sensitive fields. The commit fix (48a5d94) removes the data: parameter from asFailure(), so error responses no longer include order contents.

RemediationAI

Upgrade Craft Commerce to version 4.11.0 (for v4 deployments) or 5.6.0 (for v5 deployments). Both tagged releases are available at https://github.com/craftcms/commerce/releases/tag/4.11.0 and https://github.com/craftcms/commerce/releases/tag/5.6.0. The root fix, detailed in commit 48a5d946419964e2af1ac64a8e1acc2a32ca0a08, removes the serialized order object from the actionPay() failure response. If immediate patching is not possible, a compensating control is to restrict network access to the anonymous payment endpoint or require authentication for all payment flows at the web server or application firewall layer; note that doing so would break legitimate guest checkout functionality and should be weighed accordingly. There is no known workaround that preserves the anonymous payment feature while fully eliminating the disclosure.