{"action":"Upgrade craftcms/commerce to 4.11.2 or later.","affected":[{"fixed":"5.6.5","introduced":"5.0.0"},{"fixed":"4.11.2","introduced":"4.0.0"}],"component":"craftcms/commerce","cve_ids":["CVE-2026-55795"],"ecosystem":"Packagist","epss":0.00512,"exploited":false,"fixed_versions":["5.6.5","4.11.2"],"ghsa_id":"GHSA-h5gm-x9wr-vhcm","id":"tcs_01M5KF3BT0M6ZKC4BEGS4QBA21","modified_at":"2026-09-10T03:50:49.693876213Z","published_at":"2026-06-19T21:15:26Z","references":["https://osv.dev/vulnerability/GHSA-h5gm-x9wr-vhcm","https://github.com/craftcms/commerce/security/advisories/GHSA-h5gm-x9wr-vhcm","https://github.com/craftcms/commerce/commit/df22c4f9c4ea7fb7857d833f755e49ea6f9f5bb5","https://github.com/craftcms/commerce"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-h5gm-x9wr-vhcm","url":"https://osv.dev/vulnerability/GHSA-h5gm-x9wr-vhcm"}],"summary":"Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass"}