{"action":"Upgrade craftcms/commerce to 4.11.0 or later.","affected":[{"fixed":"5.6.0","introduced":"5.0.0"},{"fixed":"4.11.0","introduced":"4.0.0"}],"component":"craftcms/commerce","cve_ids":["CVE-2026-32270"],"ecosystem":"Packagist","epss":0.00295,"exploited":false,"fixed_versions":["5.6.0","4.11.0"],"ghsa_id":"GHSA-3vxg-x5f8-f5qf","id":"tcs_01M5KETAZ5RK8TY4JFX08GM9GA","modified_at":"2026-04-14T01:39:12.407891Z","published_at":"2026-04-14T01:01:17Z","references":["https://osv.dev/vulnerability/GHSA-3vxg-x5f8-f5qf","https://github.com/craftcms/commerce/security/advisories/GHSA-3vxg-x5f8-f5qf","https://nvd.nist.gov/vuln/detail/CVE-2026-32270","https://github.com/craftcms/commerce/commit/48a5d946419964e2af1ac64a8e1acc2a32ca0a08","https://github.com/craftcms/commerce","https://github.com/craftcms/commerce/releases/tag/4.11.0","https://github.com/craftcms/commerce/releases/tag/5.6.0"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-3vxg-x5f8-f5qf","url":"https://osv.dev/vulnerability/GHSA-3vxg-x5f8-f5qf"}],"summary":"Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments"}