GHSA-78vr-q6cf-c7p6 Craft Commerce: Partial Payment Amount Without Lower Bound Validation
Attackers can submit zero or negative payment amounts to bypass payment validation, potentially obtaining free order fulfillment.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-78vr-q6cf-c7p6?
GHSA-78vr-q6cf-c7p6 is a vulnerability in craftcms/commerce, published on 19 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Summary
The Order::setPaymentAmount() method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied 'paymentAmount' parameter directly to float with no lower-bound check.
Details
When the store has 'Allow Partial Payment on Checkout' enabled, a user can submit a payment amount of $0.00 or even a negative value, potentially marking orders as paid without a valid transaction.
<img width="690" height="80" alt="image" src="https://github.com/user-attachments/assets/78b653a6-ccae-4ce4-b71b-fc38a7757d73" />
<img width="761" height="200" alt="image" src="https://github.com/user-attachments/assets/665a235f-62c2-45fe-aa41-c3f266881c77" />
PoC
Complete instructions, including specific configuration details, to reproduce the vulnerability. <img width="606" height="144" alt="image" src="https://github.com/user-attachments/assets/a04a6de2-7c5f-4837-aed6-58756e246b80" />
Impact
On stores with partial payment enabled, a customer may be able to set an arbitrarily small payment amount. Gateway behavior varies — some will process $0.00 transactions, effectively giving free order fulfillment.
Remediation
<img width="718" height="98" alt="image" src="https://github.com/user-attachments/assets/aa64b696-9749-45e4-97f6-8d7299cdf1d6" />
Which versions are affected by GHSA-78vr-q6cf-c7p6?
4 open source packages ship an affected version, including craftcms/commerce.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/commerce Packagist | From 4.0.0 | 4.11.2 |
craftcms/commerce Packagist | From 4.0.0 | 4.11.2 |
craftcms/commerce Packagist | From 5.0.0 | 5.6.5 |
craftcms/commerce Packagist | From 5.0.0 | 5.6.5 |
How do I fix GHSA-78vr-q6cf-c7p6?
Upgrade craftcms/commerce to a fixed version for your release line: 4.11.2 or 5.6.5.
Is GHSA-78vr-q6cf-c7p6 being exploited?
There is no known exploitation of GHSA-78vr-q6cf-c7p6 in the wild and no public exploit code.