CVE-2026-55795— Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
Quick assessment
Affected
craftcms commerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Craft Commerce 是 Craft CMS 的一个电子商务平台。在版本 4.0.0 至 4.11.1 以及 5.0.0 至 5.6.4 中， 中的 仅在提供了 的 POST 或 GET 参数时才会激活其速率限制器（RateLimiter）。未经身份验证的攻击者可以向基于会话的购物车的 端点提交 值，同时省略 参数，从而阻止 IP 速率限制身份（identity）的创建，进而实现无限次的自动优惠券代码猜测和枚举。该问题已在 4.11.2 和 5.6.5 版本中修复。
Possible ATT&CK Techniques 3 AI
T1011 · Exfiltration Over Other Network Medium T1133 · External Remote Services T1110 · Brute Force
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55795
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-55795
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55795
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55795 (2)
Vendor Advisories for CVE-2026-55795 (1)
Vendor Pages for CVE-2026-55795 (2)
-
🔗 Release 5.6.5 · craftcms/commerce · GitHub x_refsource_MISC
-
🔗 Release 4.11.2 · craftcms/commerce · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: commerce
-
CVE-2026-21824
A privilege escalation vulnerability affects HCL Commerce -
CVE-2026-32272
Craft Commerce: Blind SQL Injection via hasVariant/hasProduc -
CVE-2026-32271
Craft Commerce: SQL Injection can lead to Remote Code Execut -
CVE-2026-32270
Craft Commerce: Unauthenticated information disclosure in `c -
CVE-2026-31867
Craft Commerce has a Potential IDOR in Commerce carts
Same vendor: craftcms
-
CVE-2026-79987
Low-privilege RCE through element-search eager loading -
CVE-2026-86731
Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via -
CVE-2026-86732
Craft CMS before 5.10.12 Remote Code Execution via element-i -
CVE-2026-86730
Craft CMS 5.0.0-RC1 before 5.10.12 Behavior Injection RCE -
CVE-2026-79991
Authenticated SQL Injection via nested eager-loading criteri
Same weakness: CWE-307
-
CVE-2026-91973
Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicA -
CVE-2026-91972
Vikunja before 2.6.0 Authentication Bypass via Unthrottled A -
CVE-2026-92082
Payara Server is vulnerable to brute-force login attacks due -
CVE-2026-89174
Kingdom Communication Associated｜Smart Video Intercom System -
CVE-2026-88770
Keycloak-services: keycloak-services: device authorization g
V. Comments for CVE-2026-55795
No comments yet