CVE-2026-55795 in Commerce
Summary
by MITRE • 09/14/2026
Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/14/2026
Craft Commerce contains a critical access control flaw within its CartController component that allows unauthenticated attackers to bypass rate limiting mechanisms designed to prevent brute-force attacks on coupon codes. The vulnerability exists because the RateLimiter service is conditionally activated only when specific POST or GET parameters, such as quantity, are present in the request payload. When an attacker submits a request to update the cart with a coupon code but omits these triggering parameters, the rate limiting logic fails to initialize for that session-based interaction. This oversight effectively disables the protective barrier against automated enumeration attempts, leaving the system vulnerable to high-volume guessing attacks without any throttling or blocking measures in place.
From a technical perspective, this issue stems from an incomplete implementation of security controls within the application's request handling pipeline. The developer likely assumed that certain parameters were mandatory for cart operations and thus sufficient to trigger rate limiting checks. However, by allowing requests with only coupon code data to proceed without enforcing identity-based or IP-based throttling, the system creates a significant gap in its defense-in-depth strategy. This flaw aligns closely with CWE-798: Use of Hard-coded Credentials if viewed broadly as improper authentication enforcement, but more accurately maps to CWE-307: Improper Restriction of Excessive Authentication Attempts and CWE-284: Improper Access Control. The attacker can exploit this by sending thousands of requests per minute using different coupon codes, potentially discovering valid discounts or causing denial-of-service conditions through resource exhaustion if the underlying logic is not also protected against volume at a lower level.
The operational impact of this vulnerability is severe for e-commerce platforms relying on Craft Commerce. Attackers can automate the enumeration of valid coupon codes with minimal risk of detection or interruption. This leads to direct financial loss as fraudulent discounts are applied, eroding profit margins and potentially causing inventory discrepancies if stock levels are tied to promotional usage limits that are not properly enforced due to the rate limit bypass. Furthermore, this activity can be used for reconnaissance purposes, where attackers map out which coupon codes exist in the system, gaining insights into marketing campaigns or pricing strategies. In worst-case scenarios, the ability to send unlimited requests may also contribute to server load issues, impacting availability for legitimate users and violating service level agreements related to uptime and performance stability.
Mitigation requires immediate patching to versions 4.11.2 and 5.6.5 where this logic has been corrected to ensure rate limiting is applied regardless of the presence of specific parameters like quantity. For organizations unable to patch immediately, temporary mitigations should include implementing a Web Application Firewall rule that restricts the frequency of requests to the cart update endpoint based on IP address or session ID, independent of payload content. Additionally, developers can enforce server-side validation that requires all expected fields for cart operations to be present and valid before processing any logic related to discounts or pricing adjustments. Monitoring tools should also be configured to alert on unusual spikes in coupon code submission attempts from single sources, providing an additional layer of detection against automated abuse while the underlying vulnerability is addressed. This incident highlights the importance of ensuring that security controls like rate limiting are applied universally across all entry points and request types within a sensitive business logic flow, rather than relying on implicit assumptions about parameter presence to trigger protective measures.