CVE-2026-55795
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| NVDNVD · Deferred | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.51% · top 56% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Packagistcraftcms/commerceGHSA-h5gm-x9wr-vhcm (opens in a new tab)
References (5)
- https://github.com/craftcms/commerce/security/advisories/GHSA-h5gm-x9wr-vhcm (opens in a new tab)x_refsource_CONFIRM
- https://github.com/craftcms/commerce/commit/a7d365cc33dc4c60c543defb3458bcdb5749bc13 (opens in a new tab)x_refsource_MISC
- https://github.com/craftcms/commerce/commit/df22c4f9c4ea7fb7857d833f755e49ea6f9f5bb5 (opens in a new tab)x_refsource_MISC
- https://github.com/craftcms/commerce/releases/tag/4.11.2 (opens in a new tab)x_refsource_MISC
- https://github.com/craftcms/commerce/releases/tag/5.6.5 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-h5gm-x9wr-vhcm (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-55795)Record last updated .