CVE-2026-55795: Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.p

Executive brief

Craft Commerce, an e-commerce platform for Craft CMS, contains a vulnerability that allows attackers to bypass rate limits when guessing coupon codes. By omitting a specific parameter in their requests, attackers can make unlimited attempts to discover valid discount codes. This could lead to unauthorized use of high-value discounts and loss of revenue for store owners.

Technical details

A rate limiting bypass exists in the Craft Commerce CartController's actionUpdateCart method. The RateLimiter behavior was conditionally activated only when the 'number' POST/GET parameter was explicitly provided. By submitting coupon codes against a session-based cart without this parameter, an attacker can bypass the intended rate limits. This allows for automated brute-force enumeration of valid coupon codes. The issue is fixed in versions 4.11.2 and 5.6.5 by applying rate limiting unconditionally.

Affected products

• Craft CMS Commerce >= 4.0.0, <= 4.11.1
• Craft CMS Commerce >= 5.0.0, <= 5.6.4

Timeline

• 2026-06-16: patched: Fix released in versions 4.11.2 and 5.6.5
• 2026-06-19: advisory: GitHub Advisory published

References

• https://api.github.com/users/gonzaless95
• https://github.com/gonzaless95
• https://api.github.com/users/gonzaless95/gists%7B/gist_id%7D
• https://api.github.com/users/gonzaless95/repos
• https://avatars.githubusercontent.com/u/46844074?v=4
• https://api.github.com/users/gonzaless95/events%7B/privacy%7D