{"id":"CVE-2026-55795","aliases":["GHSA-h5gm-x9wr-vhcm"],"url":"https://o3.security/vulnerability/CVE-2026-55795","summary":"Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass","details":"### Summary\n\nThe CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET parameter is explicitly provided.\n\n### Details\n\nWhen an attacker submits coupon codes against the session-based cart (without passing a 'number' parameter), no rate limiting is applied. This allows unlimited attempts to guess coupon codes.\n\n**Vulnerable Code**\n<img width=\"864\" height=\"90\" alt=\"resim\" src=\"https://github.com/user-attachments/assets/a5197f10-f1fd-4331-93f9-9479d0ceebba\" />\n\n<img width=\"881\" height=\"272\" alt=\"resim\" src=\"https://github.com/user-attachments/assets/d9db963f-5d1f-4b00-a4b4-5f2dfe2b71dd\" />\n\n<img width=\"861\" height=\"271\" alt=\"resim\" src=\"https://github.com/user-attachments/assets/f7842493-3bc0-4e99-956c-7266bab15703\" />\n\n### PoC\nComplete instructions, including specific configuration details, to reproduce the vulnerability.\n\n<img width=\"909\" height=\"171\" alt=\"resim\" src=\"https://github.com/user-attachments/assets/cfc8c994-5e0c-48de-b728-464029beba0e\" />\n\n### Impact\nAn attacker can enumerate all coupon codes through automated requests.\n\n**Remediation**\nApply rate limiting unconditionally on actionUpdateCart regardless of whether 'number' is present.","published":"2026-09-14T15:55:14Z","modified":"2026-10-21T02:58:39.669093122Z","cvss":null,"epss":{"score":0.00295,"percentile":0.22216,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/commerce","fixedVersion":"5.6.5"},{"ecosystem":"Packagist","name":"craftcms/commerce","fixedVersion":"4.11.2"}],"fix":{"url":"https://github.com/craftcms/commerce/commit/a7d365cc33dc4c60c543defb3458bcdb5749bc13","label":"craftcms/commerce@a7d365c"},"references":[{"type":"WEB","url":"https://github.com/craftcms/commerce/releases/tag/4.11.2"},{"type":"WEB","url":"https://github.com/craftcms/commerce/releases/tag/5.6.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55795.json"},{"type":"ADVISORY","url":"https://github.com/craftcms/commerce/security/advisories/GHSA-h5gm-x9wr-vhcm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55795"},{"type":"FIX","url":"https://github.com/craftcms/commerce/commit/a7d365cc33dc4c60c543defb3458bcdb5749bc13"},{"type":"FIX","url":"https://github.com/craftcms/commerce/commit/df22c4f9c4ea7fb7857d833f755e49ea6f9f5bb5"},{"type":"PACKAGE","url":"https://github.com/craftcms/commerce"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:58:39.669093122Z"}}