Craft CMS Craft Commerce improper input validation in partial payments

Executive brief

Craft Commerce is an e-commerce platform for the Craft CMS content management system. A vulnerability exists where stores with 'Partial Payments' enabled do not properly validate the payment amount submitted by customers. This allows a malicious user to submit a payment of zero or a negative value, potentially resulting in orders being marked as paid and fulfilled without any actual money being transferred.

Technical details

The vulnerability exists in the `Order::setPaymentAmount()` method and the `PaymentsController`, which cast user-supplied 'paymentAmount' parameters directly to floats without enforcing a minimum positive value. When the 'Allow Partial Payment on Checkout' setting is enabled, a remote attacker can manipulate the payment request to submit an arbitrarily small or negative amount. Depending on the specific payment gateway's behavior, this can result in the system processing $0.00 transactions as successful, leading to unauthorized order fulfillment. The issue is addressed in versions 4.11.2 and 5.6.5.

Affected products

• Craft CMS Commerce >= 4.0.0, <= 4.11.1
• Craft CMS Commerce >= 5.0.0, <= 5.6.4

Timeline

• 2026-06-16: disclosed
• 2026-06-19: advisory
• 2026-06-19: patched

References

• https://api.github.com/users/mesut-ucar
• https://github.com/mesut-ucar
• https://api.github.com/users/mesut-ucar/gists%7B/gist_id%7D
• https://api.github.com/users/mesut-ucar/repos
• https://avatars.githubusercontent.com/u/77507025?v=4
• https://api.github.com/users/mesut-ucar/events%7B/privacy%7D