Answer in brief
CVE-2026-55795 records a Medium severity vulnerability in Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass. The current sources do not mark it as known exploited. The current feed maps craftcms/commerce (composer), craftcms/commerce (composer), craftcms/commerce (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps craftcms/commerce (composer), craftcms/commerce (composer), craftcms/commerce (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| craftcms/commercecomposer | >=5.0.0,<=5.6.4 | 5.6.5 |
| craftcms/commercecomposer | >=4.0.0,<=4.11.1 | 4.11.2 |
| craftcms/commercegeneric | >= 4.0.0, < 4.11.2 || >= 5.0.0, < 5.6.5 | Not reported |
Published upstream
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to actionUpdateCart for the session-based cart while omitting number, preventing creation of the IP rate-limit identity and allowing unlimited automated coupon-code guessing and enumeration. This issue is fixed in versions 4.11.2 and 5.6.5.
Quoted source text, attributed separately from HOL analysis.