CVE-2026-55795 Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
Attackers can bypass IP rate limits to brute-force coupon codes in Craft Commerce by omitting a specific parameter, enabling unlimited automated guessing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55795?
CVE-2026-55795 is a medium-severity vulnerability in craftcms commerce, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.
Weakness: CWE-307
Which versions are affected by CVE-2026-55795?
4 open source packages ship an affected version, including craftcms/commerce.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/commerce Packagist | From 4.0.0 | 4.11.2 |
craftcms/commerce Packagist | From 4.0.0 | 4.11.2 |
craftcms/commerce Packagist | From 5.0.0 | 5.6.5 |
craftcms/commerce Packagist | From 5.0.0 | 5.6.5 |
How do I fix CVE-2026-55795?
Upgrade craftcms/commerce to a fixed version for your release line: 4.11.2 or 5.6.5.
Is CVE-2026-55795 being exploited?
There is no known exploitation of CVE-2026-55795 in the wild and no public exploit code.
Sources
Also known as GHSA-h5gm-x9wr-vhcm.