GHSA-vff3-pqq8-4cpq
Suggest an improvement- Source
- https://github.com/advisories/GHSA-vff3-pqq8-4cpq
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vff3-pqq8-4cpq/GHSA-vff3-pqq8-4cpq.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-vff3-pqq8-4cpq
- Aliases
- Published
- 2026-03-10T18:24:49Z
- Modified
- 2026-03-13T10:48:12Z
- Severity
-
- 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Craft Commerce: Potential IDOR in Commerce carts
- Details
-
An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce’s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. This vulnerability enables the takeover of shopping sessions and potential exposure of PII.
Vulnerability Details
Root Cause
The
CartControlleraccepts a user-suppliednumberparameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it.// CartController.php:374-389 - actionLoadCart() public function actionLoadCart(): ?Response { $number = $this->request->getParam('number'); if ($number === null) { return $this->asFailure(Craft::t('commerce', 'A cart number must be specified.')); } // No ownership check - returns any cart to any requester $cart = Order::find()->number($number)->isCompleted(false)->one(); // Cart is loaded into attacker's session without authorization ... }// CartController.php:606-616 - _getCart() $orderNumber = $this->request->getBodyParam('number'); if ($orderNumber) { // Same issue - no ownership validation $cart = Order::find()->number($orderNumber)->isCompleted(false)->one(); // Returns cart to any requester who knows the number }
Attack Scenario
Prerequisites
- Target Craft Commerce installation with active shopping carts
- Knowledge of a victim’s cart number (32-character hex string)
Cart Number Acquisition Vectors
- Referrer Header Leakage: Cart URLs shared externally expose the number
- Browser History: Accessible on shared/compromised devices
- Proxy/WAF Logs: Cart numbers logged in URL parameters
- Social Engineering: Support tickets, screenshots containing cart URLs
- Brute Force: While impractical for random targeting, feasible for targeted attacks against recently-created carts
- Database specific
{ "cwe_ids": [ "CWE-639" ], "github_reviewed": true, "github_reviewed_at": "2026-03-10T18:24:49Z", "nvd_published_at": "2026-03-11T18:16:25Z", "severity": "MODERATE" }- References
Affected packages
Packagist / craftcms/commerce
Package
- Name
- craftcms/commerce
- Purl
- pkg:composer/craftcms/commerce
Affected versions
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.0.10
5.0.10.1
5.0.11
5.0.11.1
5.0.12
5.0.12.1
5.0.12.2
5.0.13
5.0.14
5.0.15
5.0.16
5.0.16.1
5.0.16.2
5.0.17
5.0.18
5.0.19
5.1.0-beta.1
5.1.0-beta.2
5.1.0-beta.3
5.1.0
5.1.0.1
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.2.2.1
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.2.9
5.2.9.1
5.2.10
5.2.11
5.2.12
5.2.12.1
5.3.0
5.3.0.1
5.3.0.2
5.3.1
5.3.2
5.3.2.1
5.3.2.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.3.10
5.3.11
5.3.12
5.3.13
5.4.0
5.4.1
5.4.1.1
5.4.2
5.4.3
5.4.4
5.4.5
5.4.5.1
5.4.6
5.4.7
5.4.7.1
5.4.8
5.4.9
5.4.10
5.5.0
5.5.0.1
5.5.1
5.5.2
5.5.3
5.5.4
Packagist / craftcms/commerce
Package
- Name
- craftcms/commerce
- Purl
- pkg:composer/craftcms/commerce
Affected versions
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.1.0
4.1.1
4.1.2
4.1.3
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.5.1
4.2.6
4.2.7
4.2.8
4.2.9
4.2.10
4.2.11
4.3.0
4.3.1
4.3.2
4.3.3
4.4.0
4.4.1
4.4.1.1
4.5.0
4.5.1
4.5.1.1
4.5.2
4.5.3
4.5.4
4.6.0
4.6.1
4.6.2
4.6.3.1
4.6.4
4.6.5
4.6.6
4.6.7
4.6.8
4.6.9
4.6.10
4.6.11
4.6.12
4.6.13
4.6.14
4.7.0
4.7.1
4.7.2
4.7.3
4.8.0
4.8.0.1
4.8.1
4.8.1.1
4.8.1.2
4.8.2
4.8.3
4.8.4
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.10.0
4.10.1
4.10.2