6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31867

CVE-2026-31867: Craft Commerce has a Potential IDOR in Commerce carts

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Commerce’s cart functionality that allows users to hijack any shopping cart by knowing or guessing its 32-character number. The CartController accepts a user-supplied number parameter to load and modify shopping carts. No ownership validation is performed - the code only checks if the order exists and is incomplete, not whether the requester has authorization to access it. This vulnerability enables the takeover of shopping sessions and potential exposure of PII. This vulnerability is fixed in 4.11.0 and 5.6.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31867

CVE-2026-31867:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/commerce	composer	>= 5.0.0, < 5.6.0	5.6.0
craftcms/commerce	composer	>= 4.0.0, < 4.11.0	4.11.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in the shopping cart functionality of Craft Commerce. The root cause is that the application uses a user-provided cart number to retrieve and manage shopping carts without properly verifying that the user making the request is the owner of the cart.

Two functions in src/controllers/CartController.php were identified as vulnerable:

craftcms\commerce\controllers\CartController::actionLoadCart(): This public controller action is directly exposed to user input via the number GET parameter. The patch file for commit ceab5e47e9a5cb77dd274cba0e62cbace5c827fc shows that before the fix, this function would load any cart based on its number. The patch adds a token-based validation mechanism and checks for cart ownership if the user is logged in, thus mitigating the IDOR.
craftcms\commerce\controllers\CartController::_getCart(): Although not directly modified in the provided patch, the vulnerability description explicitly points to this private method as being vulnerable. It retrieves a cart using the number from the request body, also without ownership checks. It's likely that other public methods in the controller call this private method, and the vulnerability was fixed by adding checks in the calling methods or by refactoring the code to not use this insecure method.

The exploitation of this vulnerability would involve an attacker obtaining a victim's cart number and then using it in a request to actionLoadCart or another endpoint that uses _getCart. This would load the victim's cart into the attacker's session, allowing them to view and modify it, potentially leading to the exposure of Personally Identifiable Information (PII) and session hijacking. The patch in commit 03f55010f323d10205d5f6ff696ac832c89d737b also strengthens the cart number generation to make it less predictable, which is a hardening measure against brute-force attacks.

Vulnerable functions

craftcms\commerce\controllers\CartController::actionLoadCart

src/controllers/CartController.php

This public controller action was vulnerable to an Insecure Direct Object Reference (IDOR) attack. It accepted a 'number' parameter from a GET request and loaded the corresponding shopping cart without verifying if the user making the request was the legitimate owner of the cart. An attacker could exploit this by providing the number of a victim's cart to take over their session. The patch mitigates this by adding token-based authorization and ownership checks.

craftcms\commerce\controllers\CartController::_getCart

src/controllers/CartController.php

This private method was identified in the vulnerability description as a source of the IDOR. It retrieves a cart based on the 'number' parameter from the request body without performing any ownership validation. While not directly modified in the provided patch, its presence indicates another vector for the same vulnerability, likely called by other methods within the controller. The vulnerability was likely addressed by adding security checks in the functions that call _getCart.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.