CVE-2026-31867: craftcms commerce

Vulnerability summary

CVE-2026-31867 is a medium (CVSS 6.3) vulnerability in craftcms commerce. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 11-03-2026
   PublishedVulnerability first disclosed.
2. 12-03-2026
   Last modifiedVulnerability information updated.

Description

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce’s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. The CartController accepts a user-supplied number parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it. This vulnerability enables the takeover of shopping sessions and potential exposure of PII. This vulnerability is fixed in 4.11.0 and 5.6.0.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.