Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M
CVE-2026-31867Craft Commerce has a Potential IDOR in Commerce carts
Medium 6.3
In plain English
A medium-severity authorization bypass via user-controlled key in commerce from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce’s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. The CartController accepts a user-supplied number parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it. This vulnerability enables the takeover of shopping sessions and potential exposure of PII. This vulnerability is fixed in 4.11.0 and 5.6.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | craftcms/commerce | 5.6.0 | GHSA-vff3-pqq8-4cpq |
| Packagist | craftcms/commerce | 4.11.0 | GHSA-vff3-pqq8-4cpq |
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/craftcms/commerce/security/advisories/GHSA-vff3-pqq8-4cpq x_refsource_CONFIRM
- https://github.com/craftcms/commerce/pull/4207 x_refsource_MISC