{"id":"CVE-2026-55795","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-55795","summary":"Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass","details":"### Summary\n\nThe CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET parameter is explicitly provided.\n\n### Details\n\nWhen an attacker submits coupon codes against the session-based cart (without passing a 'number' parameter), no rate limiting is applied. This allows unlimited attempts to guess coupon codes.\n\n**Vulnerable Code**\n<img width=\"864\" height=\"90\" alt=\"resim\" src=\"https://github.com/user-attachments/assets/a5197f10-f1fd-4331-93f9-9479d0ceebba\" />\n\n<img width=\"881\" height=\"272\" alt=\"resim\" src=\"https://github.com/user-attachments/assets/d9db963f-5d1f-4b00-a4b4-5f2dfe2b71dd\" />\n\n<img width=\"861\" height=\"271\" alt=\"resim\" src=\"https://github.com/user-attachments/assets/f7842493-3bc0-4e99-956c-7266bab15703\" />\n\n### PoC\nComplete instructions, including specific configuration details, to reproduce the vulnerability.\n\n<img width=\"909\" height=\"171\" alt=\"resim\" src=\"https://github.com/user-attachments/assets/cfc8c994-5e0c-48de-b728-464029beba0e\" />\n\n### Impact\nAn attacker can enumerate all coupon codes through automated requests.\n\n**Remediation**\nApply rate limiting unconditionally on actionUpdateCart regardless of whether 'number' is present.","published":"2026-06-19T21:15:26Z","modified":"2026-06-19T21:30:08.814590453Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"craftcms/commerce","fixedVersion":"5.6.5"},{"ecosystem":"Packagist","name":"craftcms/commerce","fixedVersion":"4.11.2"}],"fix":{"url":"https://github.com/craftcms/commerce/commit/df22c4f9c4ea7fb7857d833f755e49ea6f9f5bb5","label":"craftcms/commerce@df22c4f"},"references":[{"type":"WEB","url":"https://github.com/craftcms/commerce/security/advisories/GHSA-h5gm-x9wr-vhcm"},{"type":"WEB","url":"https://github.com/craftcms/commerce/commit/df22c4f9c4ea7fb7857d833f755e49ea6f9f5bb5"},{"type":"PACKAGE","url":"https://github.com/craftcms/commerce"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-06-19T21:30:08.814590453Z"}}