Rate Limiting Vulnerability in Craft Commerce E-commerce Platform by Craft CMS
CVE-2026-55795
6.9MEDIUM
What is CVE-2026-55795?
Craft Commerce, an e-commerce platform for Craft CMS, is prone to a rate limiting failure in its CartController. An unauthenticated attacker could exploit this weakness by submitting coupon code values to the actionUpdateCart endpoint without supplying the required number parameter. This bypasses the IP rate-limit mechanism, enabling attackers to conduct unlimited coupon code guessing or enumeration attacks. This vulnerability has been addressed in Craft Commerce versions 4.11.2 and 5.6.5, which implement necessary checks to prevent such exploits.
Affected Version(s)
commerce >= 4.0.0, < 4.11.2 < 4.0.0, 4.11.2
commerce >= 5.0.0, < 5.6.5 < 5.0.0, 5.6.5