CVE-2026-32270

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32270
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32270.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-32270
Aliases
Published
2026-04-13T20:08:05.032Z
Modified
2026-08-04T11:31:09.175108017Z
Severity
  • 1.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
Craft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments
Details

Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, the PaymentsController::actionPay discloses some order data to unauthenticated users when an order number is provided and the email check fails during an anonymous payment. The JSON error response includes the serialized order object (order), which contains some sensitive fields such as customer email, shipping address, and billing address. The frontend payment flow's actionPay() retrieves orders by number before authorization is fully enforcedLoad order by number. This issue has been fixed in versions 4.11.0 and 5.6.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32270.json"
}
References

Affected packages

Git / github.com/craftcms/commerce

Affected ranges

Type
GIT
Repo
https://github.com/craftcms/commerce
Events
Introduced
03fe68b8a09d05b028c510411b55af6cea6a089a
Fixed
7f24def2a77ac196a8f1840bcf35d0fdbc7cc34e
Introduced
266ccfd800264c4a0a7c22447112c097b0af7bae
Fixed
83b72485f594f7a65cad4ad8c439c83215a8c899
Database specific 
{
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.11.0"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.6.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

5.*
5.0.0
5.0.1
5.0.10
5.0.10.1
5.0.11
5.0.11.1
5.0.12
5.0.12.1
5.0.13
5.0.14
5.0.15
5.0.16
5.0.16.1
5.0.16.2
5.0.17
5.0.18
5.0.19
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.0.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.10
5.2.11
5.2.12
5.2.12.1
5.2.2
5.2.2.1
5.2.3
5.2.4
5.2.5
5.2.8
5.2.9
5.2.9.1
5.3.0
5.3.0.1
5.3.0.2
5.3.1
5.3.10
5.3.11
5.3.12
5.3.13
5.3.2
5.3.2.1
5.3.2.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.4.0
5.4.1
5.4.1.1
5.4.10
5.4.2
5.4.3
5.4.4
5.4.5
5.4.5.1
5.4.6
5.4.7
5.4.7.1
5.4.8
5.4.9
5.5.0
5.5.0.1
5.5.1
5.5.2
5.5.3
5.5.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32270.json"