# CVE-2026-55795: Craft CMS Craft Commerce coupon brute-force via rate limit bypass

Source: https://junglewise.ai/threats/cve-2026-55795-craft-cms-craft-commerce-coupon-brute-force-via-rate-limit-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-06-19  
License: CC BY 4.0 with a link back

CVE-2026-55795 · Severity: medium · CVSS 4 · Published 2026-09-14

Craft Commerce, an e-commerce platform for Craft CMS, contains a vulnerability that allows attackers to bypass rate limits when guessing coupon codes. By omitting a specific parameter in their requests, attackers can make unlimited attempts to discover valid discount codes. This could lead to unauthorized use of high-value discounts and loss of revenue for store owners.

Technologies: [craftcms/commerce (Packagist)](https://junglewise.ai/threats/technologies/craftcms-commerce). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-55795 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55795 being exploited in the wild.

**How severe is CVE-2026-55795?** Medium severity, with a CVSS score of 4, published 14 September 2026.

**Which products and versions are affected?** craftcms/commerce (Packagist) ECOSYSTEM:introduced=5.0.0,fixed=5.6.5.

**Is there a fix for CVE-2026-55795?** Yes. craftcms/commerce (Packagist): upgrade to 5.6.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55795 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55795?** Check whether you run craftcms/commerce (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- craftcms/commerce (Packagist): upgrade to 5.6.5 or later

  ```sh
  composer require craftcms/commerce:^5.6.5
  ```


## Technical details

A rate limiting bypass exists in the Craft Commerce CartController's actionUpdateCart method. The RateLimiter behavior was conditionally activated only when the 'number' POST/GET parameter was explicitly provided. By submitting coupon codes against a session-based cart without this parameter, an attacker can bypass the intended rate limits. This allows for automated brute-force enumeration of valid coupon codes. The issue is fixed in versions 4.11.2 and 5.6.5 by applying rate limiting unconditionally.

## Affected products

- Craft CMS Commerce >= 4.0.0, <= 4.11.1
- Craft CMS Commerce >= 5.0.0, <= 5.6.4

## Identifiers

- CVE-2026-55795
- GHSA-h5gm-x9wr-vhcm

## Timeline

- 2026-06-16: patched: Fix released in versions 4.11.2 and 5.6.5
- 2026-06-19: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/gonzaless95](https://api.github.com/users/gonzaless95)
- [https://github.com/gonzaless95](https://github.com/gonzaless95)
- [https://api.github.com/users/gonzaless95/gists%7B/gist_id%7D](https://api.github.com/users/gonzaless95/gists%7B/gist_id%7D)
- [https://api.github.com/users/gonzaless95/repos](https://api.github.com/users/gonzaless95/repos)
- [https://avatars.githubusercontent.com/u/46844074?v=4](https://avatars.githubusercontent.com/u/46844074?v=4)
- [https://api.github.com/users/gonzaless95/events%7B/privacy%7D](https://api.github.com/users/gonzaless95/events%7B/privacy%7D)

## Related threats

- [Craft CMS Commerce SQL injection in Product and Variant queries](https://junglewise.ai/threats/cve-2026-32272-craft-cms-commerce-sql-injection-in-product-and-variant-queries)
- [Craft CMS Commerce SQL injection and RCE in TotalRevenue widget](https://junglewise.ai/threats/cve-2026-32271-craft-cms-commerce-sql-injection-and-rce-in-totalrevenue-widget)
- [Craft CMS Craft Commerce information disclosure in PaymentsController](https://junglewise.ai/threats/cve-2026-32270-craft-cms-craft-commerce-information-disclosure-in)
- [Craft Commerce: Potential IDOR in Commerce carts](https://junglewise.ai/threats/cve-2026-31867-craft-commerce-potential-idor-in-commerce-carts)
- [Craft Commerce has stored XSS in Craft Commerce Order Details Slideout](https://junglewise.ai/threats/cve-2026-29177-craft-commerce-has-stored-xss-in-craft-commerce-order-details)