Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord

Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

CVSS 4.0 6.9 MEDIUMCheck source for fixed versionsKEV status unknown

cve-program · CVE-2026-55795

Published

Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-55795

Published

commerce

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "craftcms",
                    "product": "commerce",
                    "versions": [
                        {
                            "version": ">= 4.0.0, < 4.11.2",
                            "status": "affected"
                        },
                        {
                            "version": ">= 5.0.0, < 5.6.5",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 13 Nov 15:18 UTC · 274 of 275 readable · 273 fully read · documentation 469/469 current