EUVD-2026-77587
GHSA-h5gm-x9wr-vhcm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable guest cart endpoint, no authentication needed, confidentiality impact limited to coupon code disclosure only.
Primary rating from Vendor (https://github.com/craftcms/commerce).
CVSS VectorVendor: https://github.com/craftcms/commerce
Lifecycle Timeline
3DescriptionCVE.org
Summary
The CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET parameter is explicitly provided.
Details
When an attacker submits coupon codes against the session-based cart (without passing a 'number' parameter), no rate limiting is applied. This allows unlimited attempts to guess coupon codes.
Vulnerable Code <img width="864" height="90" alt="resim" src="https://github.com/user-attachments/assets/a5197f10-f1fd-4331-93f9-9479d0ceebba" />
<img width="881" height="272" alt="resim" src="https://github.com/user-attachments/assets/d9db963f-5d1f-4b00-a4b4-5f2dfe2b71dd" />
<img width="861" height="271" alt="resim" src="https://github.com/user-attachments/assets/f7842493-3bc0-4e99-956c-7266bab15703" />
PoC
Complete instructions, including specific configuration details, to reproduce the vulnerability.
<img width="909" height="171" alt="resim" src="https://github.com/user-attachments/assets/cfc8c994-5e0c-48de-b728-464029beba0e" />
Impact
An attacker can enumerate all coupon codes through automated requests.
Remediation Apply rate limiting unconditionally on actionUpdateCart regardless of whether 'number' is present.
AnalysisAI
Craft Commerce's CartController exposes a coupon code brute-force vector by conditionally applying rate limiting only when the 'number' parameter is present in a request. Unauthenticated attackers targeting the session-based cart endpoint can omit the 'number' parameter entirely, bypassing IP-based rate limiting and submitting unlimited coupon code guesses via automated requests. Affected versions span the entire 4.x line through 4.11.1 and the 5.x line through 5.6.4; a proof-of-concept is referenced in the advisory, and no public exploit identified at time of analysis beyond the disclosed PoC reproduction steps.
Technical ContextAI
Craft Commerce (composer package craftcms/commerce) is a PHP-based e-commerce plugin for the Craft CMS platform. The vulnerability resides in CartController.php, which defines a RateLimiter behavior using an $isActive flag gated solely on the presence of the 'number' body or query parameter. The couponCode parameter - a separate, independently usable cart input - was not included in the rate-limit trigger logic. As a result, the RateLimiter's keyPrefix 'cart-number-rate-limit' was never engaged for coupon submission flows. The root cause is CWE-307 (Improper Restriction of Excessive Authentication Attempts), where an enumerable secret (coupon code) is submitted through a code path that lacks brute-force protection. The fix introduces a RATE_LIMITED_PARAMS constant ['number', 'couponCode'] and evaluates any member of that set to activate rate limiting, closing the bypass.
RemediationAI
Upgrade Craft Commerce to version 4.11.2 (for 4.x deployments) or 5.6.5 (for 5.x deployments), which extend rate limiting to cart requests that include a couponCode parameter. The upstream fix commit is available at https://github.com/craftcms/commerce/commit/df22c4f9c4ea7fb7857d833f755e49ea6f9f5bb5 and the advisory is at https://github.com/craftcms/commerce/security/advisories/GHSA-h5gm-x9wr-vhcm. If immediate patching is not possible, a compensating control is to implement network-layer rate limiting (e.g., via nginx limit_req or a WAF rule) targeting POST requests to the cart update endpoint that include the couponCode parameter - note this approach requires careful tuning to avoid blocking legitimate high-frequency shoppers and may not cover all edge cases in the application routing layer. Deactivating promotional coupon features entirely until patching is completed is an extreme but fully effective workaround for merchants not currently running active coupon campaigns.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today