CVE-2026-55795: Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

June 19, 2026

The CartController defines a RateLimiter behavior that is only activated when the ’number’ POST/GET parameter is explicitly provided.

References

github.com/advisories/GHSA-h5gm-x9wr-vhcm
github.com/craftcms/commerce/commit/df22c4f9c4ea7fb7857d833f755e49ea6f9f5bb5
github.com/craftcms/commerce/security/advisories/GHSA-h5gm-x9wr-vhcm
nvd.nist.gov/vuln/detail/CVE-2026-55795

Code Behaviors & Features

Detect and mitigate CVE-2026-55795 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →