CVE-2026-55795: Craft Commerce Auth Bypass Vulnerability

CVE-2026-55795 Overview

Craft Commerce, the ecommerce platform for Craft CMS, contains a rate-limiter bypass in CartController that allows unauthenticated attackers to perform unlimited coupon-code enumeration. The CartController in src/controllers/CartController.php activates its RateLimiter only when a number parameter is supplied via POST or GET. Attackers can submit couponCode values to actionUpdateCart for a session-based cart while omitting the number parameter, preventing creation of the IP rate-limit identity. The flaw affects Craft Commerce versions 4.0.0 through 4.11.1 and 5.x releases before 5.6.5. The issue is classified as improper restriction of excessive authentication attempts [CWE-307].

Critical Impact
Unauthenticated attackers can conduct unlimited automated coupon-code guessing against session-based carts, enabling discovery of valid promotional codes and financial abuse of storefronts.

Affected Products

Craft Commerce 4.0.0 through 4.11.1
Craft Commerce 5.0.0 through 5.6.4
Craft CMS storefronts using session-based cart functionality

Discovery Timeline

2026-09-14 - CVE CVE-2026-55795 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-55795

Vulnerability Analysis

The vulnerability resides in CartController::actionUpdateCart within src/controllers/CartController.php. The controller is designed to throttle cart operations using an IP-based RateLimiter to prevent enumeration and abuse. However, the rate-limiter identity is constructed only when the request contains a number parameter that identifies the target cart order.

When an attacker interacts with a session-based cart, no number parameter is required because the cart is tied to the session. Requests containing only a couponCode parameter never trigger identity creation, and the RateLimiter is not engaged. The controller processes each coupon submission and returns a distinguishable response depending on whether the code is valid.

An unauthenticated adversary can automate submissions against actionUpdateCart to enumerate valid coupon codes at machine speed. Successful enumeration yields discounts, free products, or promotional rewards not intended for the attacker.

Root Cause

The root cause is incomplete coverage of rate-limited parameters in the controller's throttling logic [CWE-307]. The pre-patch code guarded only requests carrying number, leaving couponCode submissions on session carts entirely unthrottled. This is a business logic and input-validation gap rather than a memory-safety issue.

Attack Vector

Exploitation requires no authentication, no user interaction, and only network access to any Craft Commerce storefront endpoint that exposes actionUpdateCart. An attacker issues repeated POST requests containing only a couponCode field and a session cookie, iterating through a wordlist of candidate codes without triggering IP-based throttling.

php

// Patch: src/controllers/CartController.php
 class CartController extends BaseFrontEndController
 {
+    /**
+     * Params that trigger IP-based rate limiting on cart actions.
+     */
+    public const RATE_LIMITED_PARAMS = ['number', 'couponCode'];
+
     /**
      * @var Order The cart element
      */

Source: CraftCMS Commerce Commit a7d365c

The fix introduces a RATE_LIMITED_PARAMS constant so the RateLimiter identity is created whenever either number or couponCode is supplied, closing the enumeration path. A parallel change for the 4.x branch is available in CraftCMS Commerce Commit df22c4f.

Detection Methods for CVE-2026-55795

Indicators of Compromise

High-volume POST requests to actionUpdateCart or commerce/cart/update-cart from a single source IP within a short time window.
Requests to the cart update endpoint containing a couponCode parameter but no number parameter.
Repeated failed coupon submissions producing consistent "invalid coupon" responses followed by a successful application.
Anomalous spikes in coupon redemption events across a narrow set of promotional codes.

Detection Strategies

Parse web server access logs for sequential requests to the cart update route with varying couponCode values from the same client IP or session.
Correlate PHP application logs with WAF telemetry to identify enumeration patterns that lack the number parameter.
Alert on any single session ID that submits more than a configurable threshold of coupon attempts within an hourly window.

Monitoring Recommendations

Deploy WAF rules that inspect POST bodies to actionUpdateCart and rate-limit requests containing couponCode.
Instrument Craft Commerce with application-level telemetry for coupon validation failures and forward to a centralized log pipeline.
Monitor upstream CDN or load balancer metrics for burst traffic against cart endpoints originating from residential proxy ranges.

How to Mitigate CVE-2026-55795

Immediate Actions Required

Upgrade Craft Commerce to version 4.11.2 (for 4.x deployments) or 5.6.5 (for 5.x deployments) without delay.
Audit recent coupon redemption logs for evidence of enumeration and revoke promotional codes that show suspicious usage patterns.
Enforce an edge rate-limit rule on the cart update route until the patched version is deployed.

Patch Information

Craft CMS released fixed versions Craft Commerce 4.11.2 and Craft Commerce 5.6.5. The remediation is documented in the GHSA-h5gm-x9wr-vhcm advisory and implemented across the commits referenced above.

Workarounds

Add a reverse-proxy or WAF rule that throttles requests to actionUpdateCart per source IP regardless of request parameters.
Temporarily disable coupon functionality on the storefront until upgrading to a patched release.
Rotate active coupon codes to high-entropy values to reduce the success probability of enumeration attacks.

bash

# Composer upgrade example for Craft Commerce
composer require craftcms/commerce:^5.6.5 -w
# Or for the 4.x branch
composer require craftcms/commerce:^4.11.2 -w
php craft up