CVE-2026-32270

Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, the PaymentsController::actionPay discloses some order data to unauthenticated users when an order number is provided and the email check fails during an anonymous payment. The JSON error response includes the serialized order object (order), which contains some sensitive fields such as customer email, shipping address, and billing address. The frontend payment flow's actionPay() retrieves orders by number before authorization is fully enforcedLoad order by number. This issue has been fixed in versions 4.11.0 and 5.6.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/craftcms/commerce/commit/48a5d946419964e2af1ac64a8e1acc2a32ca0a08
https://github.com/craftcms/commerce/releases/tag/4.11.0
https://github.com/craftcms/commerce/releases/tag/5.6.0
https://github.com/craftcms/commerce/security/advisories/GHSA-3vxg-x5f8-f5qf

Configurations

No configuration.

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Craft Commerce es una plataforma de comercio electrónico para Craft CMS. En las versiones 4.0.0 a 4.10.2 y 5.0.0 a 5.5.4, el PaymentsController::actionPay divulga algunos datos del pedido a usuarios no autenticados cuando se proporciona un número de pedido y la verificación del correo electrónico falla durante un pago anónimo. La respuesta de error JSON incluye el objeto de pedido serializado (order), que contiene algunos campos sensibles como el correo electrónico del cliente, la dirección de envío y la dirección de facturación. El actionPay() del flujo de pago del frontend recupera pedidos por número antes de que la autorización se aplique completamente. Cargar pedido por número. Este problema ha sido solucionado en las versiones 4.11.0 y 5.6.0.

Information

Published : 2026-04-13 20:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-32270

Mitre link : CVE-2026-32270

CVE.ORG link : CVE-2026-32270

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-862

Missing Authorization

{"id": "CVE-2026-32270", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32270", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T15:24:48.497153Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "craftcms", "product": "commerce", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.11.0"}, {"status": "affected", "version": ">= 5.0.0, < 5.6.0"}]}]}], "published": "2026-04-13T20:16:33.527", "references": [{"url": "https://github.com/craftcms/commerce/commit/48a5d946419964e2af1ac64a8e1acc2a32ca0a08", "source": "security-advisories@github.com"}, {"url": "https://github.com/craftcms/commerce/releases/tag/4.11.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/craftcms/commerce/releases/tag/5.6.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/craftcms/commerce/security/advisories/GHSA-3vxg-x5f8-f5qf", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, the PaymentsController::actionPay discloses some order data to unauthenticated users when an order number is provided and the email check fails during an anonymous payment. The JSON error response includes the serialized order object (order), which contains some sensitive fields such as customer email, shipping address, and billing address. The frontend payment flow's actionPay() retrieves orders by number before authorization is fully enforcedLoad order by number. This issue has been fixed in versions 4.11.0 and 5.6.0."}, {"lang": "es", "value": "Craft Commerce es una plataforma de comercio electr\u00f3nico para Craft CMS. En las versiones 4.0.0 a 4.10.2 y 5.0.0 a 5.5.4, el PaymentsController::actionPay divulga algunos datos del pedido a usuarios no autenticados cuando se proporciona un n\u00famero de pedido y la verificaci\u00f3n del correo electr\u00f3nico falla durante un pago an\u00f3nimo. La respuesta de error JSON incluye el objeto de pedido serializado (order), que contiene algunos campos sensibles como el correo electr\u00f3nico del cliente, la direcci\u00f3n de env\u00edo y la direcci\u00f3n de facturaci\u00f3n. El actionPay() del flujo de pago del frontend recupera pedidos por n\u00famero antes de que la autorizaci\u00f3n se aplique completamente. Cargar pedido por n\u00famero. Este problema ha sido solucionado en las versiones 4.11.0 y 5.6.0."}], "lastModified": "2026-10-26T22:10:00.163", "sourceIdentifier": "security-advisories@github.com"}