CVE-2026-32270 Details
Description
Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, the PaymentsController::actionPay discloses some order data to unauthenticated users when an order number is provided and the email check fails during an anonymous payment. The JSON error response includes the serialized order object (order), which contains some sensitive fields such as customer email, shipping address, and billing address. The frontend payment flow's actionPay() retrieves orders by number before authorization is fully enforcedLoad order by number. This issue has been fixed in versions 4.11.0 and 5.6.0.
A vulnerability in Craft Commerce's PaymentsController::actionPay method allows unauthenticated users to access sensitive order information during anonymous payments. This issue affects Craft Commerce versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4. The vulnerability arises because the action retrieves orders by number before fully enforcing authorization. When an order number is provided and the email verification fails, the response includes a serialized order object containing sensitive details such as the customer's email, shipping address, and billing address.
Users can upgrade to Craft Commerce versions 4.11.0 or 5.6.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 13, 2026CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/craftcms/commerce/commit/48a5d946419964e2af1ac64a8e1acc2a32ca0a08 | [email protected] | Source CodeVendor |
| https://github.com/craftcms/commerce/releases/tag/4.11.0 | [email protected] | Release NotesVendor |
| https://github.com/craftcms/commerce/releases/tag/5.6.0 | [email protected] | Release NotesVendor |
| https://github.com/craftcms/commerce/security/advisories/GHSA-3vxg-x5f8-f5qf | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Craft Commerce | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | New CVE Received | [email protected] |