GHSA-78vr-q6cf-c7p6Medium▾ SunlitCraft Commerce: Partial Payment Amount Without Lower Bound Validation
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Order::setPaymentAmount() method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied 'paymentAmount' parameter directly to float with no lower-bound check.
When the store has 'Allow Partial Payment on Checkout' enabled, a user can submit a payment amount of $0.00 or even a negative value, potentially marking orders as paid without a valid transaction.
<img width="690" height="80" alt="image" src="https://github.com/user-attachments/assets/78b653a6-ccae-4ce4-b71b-fc38a7757d73" /> <img width="761" height="200" alt="image" src="https://github.com/user-attachments/assets/665a235f-62c2-45fe-aa41-c3f266881c77" />Complete instructions, including specific configuration details, to reproduce the vulnerability. <img width="606" height="144" alt="image" src="https://github.com/user-attachments/assets/a04a6de2-7c5f-4837-aed6-58756e246b80" />
On stores with partial payment enabled, a customer may be able to set an arbitrarily small payment amount. Gateway behavior varies — some will process $0.00 transactions, effectively giving free order fulfillment.
Remediation
<img width="718" height="98" alt="image" src="https://github.com/user-attachments/assets/aa64b696-9749-45e4-97f6-8d7299cdf1d6" />craftcms/commerce >= 5.0.0, <= 5.6.4craftcms/commerce >= 4.0.0, <= 4.11.1Upgrade to a patched release:
craftcms/commerce 5.6.5craftcms/commerce 4.11.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116172Medium· 5.9vllm: vLLM: Denial of Service via improper input validation in Rust gRPC interface (CVE-2026-116172)
CVE-2026-32267HighCraft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
CVE-2026-105754Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-53587High· 7.5libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application
CVE-2026-79376High· 8.8An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service (DoS) via sending a crafted L2CAP packet.
GHSA-xxpx-f366-4xpqMediumCraft CMS:Authorization bypass: view-only Categories user can modify category structure via structures/move-element