CVE-2026-31867

MEDIUM

Craft Commerce has a Potential IDOR in Commerce carts

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-31867 has a selected CVSS score of 6.3 (medium).

Description

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce’s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. The CartController accepts a user-supplied number parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it. This vulnerability enables the takeover of shopping sessions and potential exposure of PII. This vulnerability is fixed in 4.11.0 and 5.6.0.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 12, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

commerce

Browse craftcms / commerce
CVE List>= 4.0.0, < 4.11.0affected
>= 5.0.0, < 5.6.0affected

craftcms/commerce

Browse Packagist / craftcms/commerce
GitHub Advisory5.0.0 to < 5.6.0 · Fixed in 5.6.0affected
4.0.0 to < 4.11.0 · Fixed in 4.11.0affected

References

4