PT-2026-32511 · Unknown · Craft Commerce

Tianluov · Published 2026-04-13 · Updated 2026-04-28 · CVE-2026-32270

Positive Technologies (AI Summary)

CVSS v4.0

1.7

Low

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Craft Commerce versions prior to 4.11.0 Craft Commerce versions prior to 5.6.0

Description The actionPay() function in the 'PaymentsController' discloses order data to unauthenticated users. This occurs when an order number is provided and the email check fails during an anonymous payment. The resulting JSON error response contains the serialized order object order, which includes sensitive information such as customer email, shipping address, and billing address. This happens because the actionPay() function retrieves orders by number before authorization is fully enforced.

Recommendations Update to version 4.11.0 for versions prior to 4.11.0. Update to version 5.6.0 for versions prior to 5.6.0. As a temporary workaround, consider restricting access to the actionPay() function.

Fix

Information Disclosure

Missing Authorization

Weakness Enumeration

CWE-200

CWE-862

Related Identifiers

CVE-2026-32270

GHSA-3VXG-X5F8-F5QF

Affected Products

Craft Commerce

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-32270 · Security Note
• https://osv.dev/vulnerability/GHSA-3vxg-x5f8-f5qf · Vendor Advisory
• https://github.com/craftcms/commerce · Note
• https://github.com/craftcms/commerce/releases/tag/4.11.0 · Note
• https://github.com/craftcms/commerce/commit/48a5d946419964e2af1ac64a8e1acc2a32ca0a08 · Note
• https://github.com/craftcms/commerce/security/advisories/GHSA-3vxg-x5f8-f5qf · Note
• https://github.com/craftcms/commerce/releases/tag/5.6.0 · Note
• https://twitter.com/VulmonFeeds/status/2043921591889764782 · Twitter Post
• https://twitter.com/_cvereports/status/2049068777153745341 · Twitter Post
• https://twitter.com/CVEnew/status/2043976207322984470 · Twitter Post