CVE-2026-32270 craftcms CVE debrief

Who should care

Defenders responsible for ecommerce platforms using Craft Commerce, particularly those using versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, should assess exposure and prioritize updates to versions 4.11.0 or 5.6.0.

Why it matters

CVE-2026-32270 is a vulnerability in Craft Commerce that discloses order data to unauthenticated users. Defenders should prioritize verifying exposure and updating affected systems to prevent potential unauthorized access to sensitive order information.

• Potential exposure of sensitive order data, including customer email, shipping address, and billing address.
• Possible unauthorized access to order information through the PaymentsController::actionPay.
• Need for verification of inventory and order data handling in affected versions.
• Priority for updating to versions 4.11.0 or 5.6.0 to address the vulnerability.

Technical summary

The PaymentsController::actionPay in Craft Commerce discloses some order data to unauthenticated users when an order number is provided and the email check fails during an anonymous payment. The JSON error response includes the serialized order object, which contains sensitive fields such as customer email, shipping address, and billing address. This vulnerability affects Craft Commerce versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4. The issue allows potential unauthorized access to sensitive order information. Defenders should prioritize verifying exposure and updating affected systems to prevent potential unauthorized access to sensitive order information.

Defensive priority

Defenders should prioritize verifying exposure in ecommerce platforms using Craft Commerce versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, and assess the need for updates to versions 4.11.0 or 5.6.0.

Recommended defensive actions

• Verify exposure in ecommerce platforms using Craft Commerce versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4.
• Assess the need for updates to versions 4.11.0 or 5.6.0.
• Review order data handling and authentication in the PaymentsController::actionPay.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Craft Commerce, including affected versions and fixed versions. However, the corpus does not provide explicit information on exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.