CVE-2026-31867 Details
Description
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce’s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. The CartController accepts a user-supplied number parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it. This vulnerability enables the takeover of shopping sessions and potential exposure of PII. This vulnerability is fixed in 4.11.0 and 5.6.0.
An Insecure Direct Object Reference (IDOR) vulnerability has been identified in Craft Commerce versions prior to 4.11.0 and 5.6.0. This vulnerability allows users to hijack any shopping cart by knowing or guessing its 32-character number. The issue arises in the CartController, which accepts a user-supplied number parameter to load and modify shopping carts. The controller fails to perform ownership validation, only checking if the order exists and is incomplete. As a result, this vulnerability enables the unauthorized takeover of shopping sessions and the potential exposure of personally identifiable information (PII).
Users can update to Craft Commerce versions 4.11.0 or 5.6.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/craftcms/commerce/pull/4207 | [email protected] | Issue TrackingPatch |
| https://github.com/craftcms/commerce/security/advisories/GHSA-vff3-pqq8-4cpq | [email protected] | ExploitPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| craftcms craft commerce | >= 4.0.0, < 4.11.0 >= 5.0.0, < 5.6.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | New CVE Received | [email protected] |