PT-2026-51114 · Packagist · Craftcms/Commerce

Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-55795

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

The CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET parameter is explicitly provided.

Details

When an attacker submits coupon codes against the session-based cart (without passing a 'number' parameter), no rate limiting is applied. This allows unlimited attempts to guess coupon codes.

Vulnerable Code

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

Impact

An attacker can enumerate all coupon codes through automated requests.

Remediation Apply rate limiting unconditionally on actionUpdateCart regardless of whether 'number' is present.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-55795

GHSA-H5GM-X9WR-VHCM

Affected Products

Craftcms/Commerce

References · 4

• https://osv.dev/vulnerability/GHSA-h5gm-x9wr-vhcm · Vendor Advisory
• https://github.com/craftcms/commerce · Note
• https://github.com/craftcms/commerce/commit/df22c4f9c4ea7fb7857d833f755e49ea6f9f5bb5 · Note
• https://github.com/craftcms/commerce/security/advisories/GHSA-h5gm-x9wr-vhcm · Note