CVE-2026-55795

Deferred Deferred - Pending Action

Authentication Bypass in Craft Commerce via Rate Limiter Bypass

Publication date: 2026-09-14

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-30

Generated

2026-11-08

AI Q&A

2026-09-14

EPSS Evaluated

2026-11-07

NVD

CVE-2026-55795

EUVD

EUVD-2026-77587

Affected Vendors & Products

Vendor	Product	Version / Range
craftcms	craft_commerce	to 4.11.2 (inc)
craftcms	craft_commerce	5.6.5
craftcms	commerce	From 4.0.0 (inc) to 4.11.1 (inc)
craftcms	commerce	4.11.2
craftcms	commerce	From 5.0.0 (inc) to 5.6.4 (inc)
craftcms	commerce	5.6.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

Craft Commerce versions 4.0.0 to 4.11.2 and 5.6.5 have a vulnerability in CartController where the RateLimiter is only activated if a POST or GET parameter named number is provided. An attacker can exploit this by submitting couponCode values without the number parameter, bypassing IP-based rate limiting and enabling automated coupon code guessing and enumeration attacks.

Detection Guidance

Detecting this vulnerability requires monitoring for excessive coupon code guessing attempts. Check web server logs for repeated POST requests to /actions/commerce/cart/update-cart without the number parameter. Look for patterns of rapid, automated submissions targeting the cart endpoint.

Impact Analysis

An unauthenticated attacker could exploit this to repeatedly guess or enumerate valid coupon codes without rate limits, potentially leading to unauthorized discounts or exposure of sensitive information tied to coupon usage. This could result in financial loss or data breaches for users of affected Craft Commerce versions.

Compliance Impact

This vulnerability primarily enables brute-force attacks on coupon codes, which could lead to unauthorized access or misuse of ecommerce functionality. While not directly violating GDPR or HIPAA, such vulnerabilities may create pathways for data breaches or unauthorized transactions, potentially compromising personal or health data if exploited. Organizations using affected versions should assess exposure risks to compliance.

Mitigation Strategies

Upgrade Craft Commerce to version 4.11.2 or 5.6.5 or later. If immediate upgrade is not possible, implement rate limiting at the web server or application level to block repeated requests without the number parameter. Review and restrict access to the cart update endpoint.

Hi! I’m here to help you understand CVE-2026-55795. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...