CVE-2026-55795
Received Received - Intake

Authentication Bypass in Craft Commerce via Rate Limiter Bypass

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-55795
EUVD
EUVD-2026-77587

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
craftcms craft_commerce to 4.11.2 (inc)
craftcms craft_commerce 5.6.5
craftcms commerce From 4.0.0 (inc) to 4.11.1 (inc)
craftcms commerce 4.11.2
craftcms commerce From 5.0.0 (inc) to 5.6.4 (inc)
craftcms commerce 5.6.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Craft Commerce versions 4.0.0 to 4.11.2 and 5.6.5 have a vulnerability in CartController where the RateLimiter is only activated if a POST or GET parameter named number is provided. An attacker can exploit this by submitting couponCode values without the number parameter, bypassing IP-based rate limiting and enabling automated coupon code guessing and enumeration attacks.

Detection Guidance

Detecting this vulnerability requires monitoring for excessive coupon code guessing attempts. Check web server logs for repeated POST requests to /actions/commerce/cart/update-cart without the number parameter. Look for patterns of rapid, automated submissions targeting the cart endpoint.

Impact Analysis

An unauthenticated attacker could exploit this to repeatedly guess or enumerate valid coupon codes without rate limits, potentially leading to unauthorized discounts or exposure of sensitive information tied to coupon usage. This could result in financial loss or data breaches for users of affected Craft Commerce versions.

Compliance Impact

This vulnerability primarily enables brute-force attacks on coupon codes, which could lead to unauthorized access or misuse of ecommerce functionality. While not directly violating GDPR or HIPAA, such vulnerabilities may create pathways for data breaches or unauthorized transactions, potentially compromising personal or health data if exploited. Organizations using affected versions should assess exposure risks to compliance.

Mitigation Strategies

Upgrade Craft Commerce to version 4.11.2 or 5.6.5 or later. If immediate upgrade is not possible, implement rate limiting at the web server or application level to block repeated requests without the number parameter. Review and restrict access to the cart update endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart