Insecure Direct Object Reference in Craft Commerce by Craft CMS
CVE-2026-31867

6.3MEDIUM

Key Information:

Vendor

Craftcms

Status
Commerce
Vendor
CVE Published:
11 March 2026

What is CVE-2026-31867?

Craft Commerce, an e-commerce platform for Craft CMS, contains an Insecure Direct Object Reference (IDOR) vulnerability in its cart functionality. This allows attackers to hijack any user's shopping cart by merely knowing or guessing its unique 32-character identifier. The vulnerable CartController accepts a number parameter to load and manipulate carts without validating user ownership. This flaw can lead to unauthorized access to shopping sessions and possible exposure of personal identifiable information (PII). To mitigate this issue, it is essential to upgrade to Craft Commerce versions 4.11.0 or 5.6.0 or later.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

commerce >= 4.0.0, < 4.11.0 < 4.0.0, 4.11.0

commerce >= 5.0.0, < 5.6.0 < 5.0.0, 5.6.0

References

https://github.com/craftcms/commerce/security/advisories/...
x_refsource_CONFIRM
https://github.com/craftcms/commerce/pull/4207
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.