PT-2026-51114 · Packagist · Craftcms/Commerce

Publicado 2026-06-19 · Atualizado 2026-06-19 · CVE-2026-55795

OSV

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

The CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET parameter is explicitly provided.

Details

When an attacker submits coupon codes against the session-based cart (without passing a 'number' parameter), no rate limiting is applied. This allows unlimited attempts to guess coupon codes.

Vulnerable Code

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

Impact

An attacker can enumerate all coupon codes through automated requests.

Remediation Apply rate limiting unconditionally on actionUpdateCart regardless of whether 'number' is present.

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2026-55795

GHSA-H5GM-X9WR-VHCM

Produtos afetados

Craftcms/Commerce

Referências · 4

• https://github.com/craftcms/commerce · Nota
• https://github.com/craftcms/commerce/commit/df22c4f9c4ea7fb7857d833f755e49ea6f9f5bb5 · Nota
• https://github.com/craftcms/commerce/security/advisories/GHSA-h5gm-x9wr-vhcm · Nota
• https://osv.dev/vulnerability/GHSA-h5gm-x9wr-vhcm · Aviso do Fabricante