Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
Craft Commerce: User Can Make Partial Payments Without Minimum Amount
published 4 months ago
Summary
A user can submit a payment amount of $0 or a negative value, potentially marking orders as paid without a valid transaction. This can happen on stores that allow partial payments on checkout. To fix this, the payment amount should be checked to ensure it's a positive number.
What to do
- Update craftcms commerce to version 5.6.5.
- Update craftcms commerce to version 4.11.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | craftcms | commerce |
>= 5.0.0, <= 5.6.4 >= 4.0.0, <= 4.11.1 Fix: upgrade to 5.6.5
|
Original advisory text
Craft Commerce: Partial Payment Amount Without Lower Bound Validation
### Summary
The `Order::setPaymentAmount()` method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied 'paymentAmount' parameter directly to float with no lower-bound check.
### Details
When the store has 'Allow Partial Payment on Checkout' enabled, a user can submit a payment amount of $0.00 or even a negative value, potentially marking orders as paid without a valid transaction.
<img width="690" height="80" alt="image" src="https://github.com/user-attachments/assets/78b653a6-ccae-4ce4-b71b-fc38a7757d73" />
<img width="761" height="200" alt="image" src="https://github.com/user-attachments/assets/665a235f-62c2-45fe-aa41-c3f266881c77" />
### PoC
_Complete instructions, including specific configuration details, to reproduce the vulnerability._
<img width="606" height="144" alt="image" src="https://github.com/user-attachments/assets/a04a6de2-7c5f-4837-aed6-58756e246b80" />
### Impact
On stores with partial payment enabled, a customer may be able to set an arbitrarily small payment amount. Gateway behavior varies — some will process $0.00 transactions, effectively giving free order fulfillment.
**Remediation**
<img width="718" height="98" alt="image" src="https://github.com/user-attachments/assets/aa64b696-9749-45e4-97f6-8d7299cdf1d6" />
The `Order::setPaymentAmount()` method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied 'paymentAmount' parameter directly to float with no lower-bound check.
### Details
When the store has 'Allow Partial Payment on Checkout' enabled, a user can submit a payment amount of $0.00 or even a negative value, potentially marking orders as paid without a valid transaction.
<img width="690" height="80" alt="image" src="https://github.com/user-attachments/assets/78b653a6-ccae-4ce4-b71b-fc38a7757d73" />
<img width="761" height="200" alt="image" src="https://github.com/user-attachments/assets/665a235f-62c2-45fe-aa41-c3f266881c77" />
### PoC
_Complete instructions, including specific configuration details, to reproduce the vulnerability._
<img width="606" height="144" alt="image" src="https://github.com/user-attachments/assets/a04a6de2-7c5f-4837-aed6-58756e246b80" />
### Impact
On stores with partial payment enabled, a customer may be able to set an arbitrarily small payment amount. Gateway behavior varies — some will process $0.00 transactions, effectively giving free order fulfillment.
**Remediation**
<img width="718" height="98" alt="image" src="https://github.com/user-attachments/assets/aa64b696-9749-45e4-97f6-8d7299cdf1d6" />
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-20Improper Input Validation
CWE-1284Improper Validation of Specified Quantity in Input
Timeline
Published19 Jun 2026
Updated19 Jun 2026
First seen19 Jun 2026
Sources
GHSA-78vr-q6cf-c7p6 · GHSA
Track software like this
Free during beta