Is there a patch available for CVE-2026-55795?

Yes, a patch is available for CVE-2026-55795. Update the affected software to the latest version immediately.

Craft Commerce CVE-2026-55795

Q: What is the CVSS score of CVE-2026-55795?

CVE-2026-55795 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-77587 MEDIUM

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-06-19 https://github.com/craftcms/commerce

GHSA-h5gm-x9wr-vhcm

Information Disclosure

6.9

CVSS 4.0 · Vendor: https://github.com/craftcms/commerce

Severity by source

Vendor (https://github.com/craftcms/commerce) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable guest cart endpoint, no authentication needed, confidentiality impact limited to coupon code disclosure only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/craftcms/commerce).

CVSS VectorVendor: https://github.com/craftcms/commerce

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Sep 14, 2026 - 16:22 NVD

6.9 (MEDIUM)

Source Code Evidence Fetched

Jun 19, 2026 - 23:37 vuln.today

Analysis Generated

Jun 19, 2026 - 23:37 vuln.today

DescriptionCVE.org

Summary

The CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET parameter is explicitly provided.

Details

When an attacker submits coupon codes against the session-based cart (without passing a 'number' parameter), no rate limiting is applied. This allows unlimited attempts to guess coupon codes.

Vulnerable Code <img width="864" height="90" alt="resim" src="https://github.com/user-attachments/assets/a5197f10-f1fd-4331-93f9-9479d0ceebba" />

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

Impact

An attacker can enumerate all coupon codes through automated requests.

Remediation Apply rate limiting unconditionally on actionUpdateCart regardless of whether 'number' is present.

AnalysisAI

Craft Commerce's CartController exposes a coupon code brute-force vector by conditionally applying rate limiting only when the 'number' parameter is present in a request. Unauthenticated attackers targeting the session-based cart endpoint can omit the 'number' parameter entirely, bypassing IP-based rate limiting and submitting unlimited coupon code guesses via automated requests. Affected versions span the entire 4.x line through 4.11.1 and the 5.x line through 5.6.4; a proof-of-concept is referenced in the advisory, and no public exploit identified at time of analysis beyond the disclosed PoC reproduction steps.

Technical ContextAI

Craft Commerce (composer package craftcms/commerce) is a PHP-based e-commerce plugin for the Craft CMS platform. The vulnerability resides in CartController.php, which defines a RateLimiter behavior using an $isActive flag gated solely on the presence of the 'number' body or query parameter. The couponCode parameter - a separate, independently usable cart input - was not included in the rate-limit trigger logic. As a result, the RateLimiter's keyPrefix 'cart-number-rate-limit' was never engaged for coupon submission flows. The root cause is CWE-307 (Improper Restriction of Excessive Authentication Attempts), where an enumerable secret (coupon code) is submitted through a code path that lacks brute-force protection. The fix introduces a RATE_LIMITED_PARAMS constant ['number', 'couponCode'] and evaluates any member of that set to activate rate limiting, closing the bypass.

RemediationAI

Upgrade Craft Commerce to version 4.11.2 (for 4.x deployments) or 5.6.5 (for 5.x deployments), which extend rate limiting to cart requests that include a couponCode parameter. The upstream fix commit is available at https://github.com/craftcms/commerce/commit/df22c4f9c4ea7fb7857d833f755e49ea6f9f5bb5 and the advisory is at https://github.com/craftcms/commerce/security/advisories/GHSA-h5gm-x9wr-vhcm. If immediate patching is not possible, a compensating control is to implement network-layer rate limiting (e.g., via nginx limit_req or a WAF rule) targeting POST requests to the cart update endpoint that include the couponCode parameter - note this approach requires careful tuning to avoid blocking legitimate high-frequency shoppers and may not cover all edge cases in the application routing layer. Deactivating promotional coupon features entirely until patching is completed is an extreme but fully effective workaround for merchants not currently running active coupon campaigns.