{"action":"Upgrade craftcms/commerce to 4.11.0 or later.","affected":[{"fixed":"5.6.0","introduced":"5.0.0"},{"fixed":"4.11.0","introduced":"4.0.0"}],"component":"craftcms/commerce","cve_ids":["CVE-2026-31867"],"ecosystem":"Packagist","epss":0.00295,"exploited":false,"fixed_versions":["5.6.0","4.11.0"],"ghsa_id":"GHSA-vff3-pqq8-4cpq","id":"tcs_01M5KF94AQ60TK5HC0S8DZHANK","modified_at":"2026-03-13T10:48:12.376823Z","published_at":"2026-03-10T18:24:49Z","references":["https://osv.dev/vulnerability/GHSA-vff3-pqq8-4cpq","https://github.com/craftcms/commerce/security/advisories/GHSA-vff3-pqq8-4cpq","https://nvd.nist.gov/vuln/detail/CVE-2026-31867","https://github.com/craftcms/commerce/pull/4207","https://github.com/craftcms/commerce"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-vff3-pqq8-4cpq","url":"https://osv.dev/vulnerability/GHSA-vff3-pqq8-4cpq"},{"source":"nvd","source_id":"CVE-2026-31867","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31867"}],"summary":"Craft Commerce: Potential IDOR in Commerce carts"}