GHSA-78vr-q6cf-c7p6
Suggest an improvement- Source
- https://github.com/advisories/GHSA-78vr-q6cf-c7p6
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-78vr-q6cf-c7p6/GHSA-78vr-q6cf-c7p6.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-78vr-q6cf-c7p6
- Published
- 2026-06-19T21:15:23Z
- Modified
- 2026-09-10T03:50:48Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Craft Commerce: Partial Payment Amount Without Lower Bound Validation
- Details
-
Summary
The
Order::setPaymentAmount()method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied 'paymentAmount' parameter directly to float with no lower-bound check.Details
When the store has 'Allow Partial Payment on Checkout' enabled, a user can submit a payment amount of $0.00 or even a negative value, potentially marking orders as paid without a valid transaction.
PoC
Complete instructions, including specific configuration details, to reproduce the vulnerability.
Impact
On stores with partial payment enabled, a customer may be able to set an arbitrarily small payment amount. Gateway behavior varies — some will process $0.00 transactions, effectively giving free order fulfillment.
Remediation
- Database specific
{ "cwe_ids": [ "CWE-1284", "CWE-20" ], "github_reviewed": true, "github_reviewed_at": "2026-06-19T21:15:23Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
Packagist / craftcms/commerce
Package
- Name
- craftcms/commerce
- Purl
- pkg:composer/craftcms/commerce
Affected versions
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.0.10
5.0.10.1
5.0.11
5.0.11.1
5.0.12
5.0.12.1
5.0.12.2
5.0.13
5.0.14
5.0.15
5.0.16
5.0.16.1
5.0.16.2
5.0.17
5.0.18
5.0.19
5.1.0-beta.1
5.1.0-beta.2
5.1.0-beta.3
5.1.0
5.1.0.1
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.2.2.1
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.2.9.1
5.2.10
5.2.11
5.2.12
5.2.12.1
5.3.0
5.3.0.1
5.3.0.2
5.3.1
5.3.2
5.3.2.1
5.3.2.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.3.10
5.3.11
5.3.12
5.3.13
5.4.0
5.4.1
5.4.1.1
5.4.2
5.4.3
5.4.4
5.4.5
5.4.5.1
5.4.6
5.4.7
5.4.7.1
5.4.8
5.4.9
5.4.10
5.5.0
5.5.0.1
5.5.1
5.5.2
5.5.3
5.5.4
5.6.0
5.6.1
5.6.1.1
5.6.2
5.6.3
5.6.4
Packagist / craftcms/commerce
Package
- Name
- craftcms/commerce
- Purl
- pkg:composer/craftcms/commerce
Affected versions
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.1.2
4.1.3
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.5.1
4.2.6
4.2.7
4.2.8
4.2.9
4.2.10
4.2.11
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0
4.4.1
4.4.1.1
4.5.0
4.5.1
4.5.1.1
4.5.2
4.5.3
4.5.4
4.6.0
4.6.1
4.6.2
4.6.3.1
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.7.0
4.7.1
4.7.2
4.7.3
4.8.0
4.8.0.1
4.8.1
4.8.1.1
4.8.1.2
4.8.2
4.8.3
4.8.4
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.10.0
4.10.1
4.10.2
4.11.0
4.11.0.1
4.11.1