{"id":"GHSA-78vr-q6cf-c7p6","title":"Craft Commerce: Partial Payment Amount Without Lower Bound Validation","summary":"Craft Commerce: Partial Payment Amount Without Lower Bound Validation","severity":"medium","cwe":["CWE-20","CWE-1284"],"vendor":"craftcms","product":"craftcms/commerce","ecosystem":"composer","affected":["craftcms/commerce >= 5.0.0, <= 5.6.4","craftcms/commerce >= 4.0.0, <= 4.11.1"],"patched":["craftcms/commerce 5.6.5","craftcms/commerce 4.11.2"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-78vr-q6cf-c7p6","references":[{"url":"https://github.com/craftcms/commerce/security/advisories/GHSA-78vr-q6cf-c7p6"},{"url":"https://github.com/craftcms/commerce/commit/9a88392b3074aa132a9455d4f4b582411df52c74"},{"url":"https://github.com/advisories/GHSA-78vr-q6cf-c7p6"}],"tags":["ghsa","composer"],"ingestedAt":"2026-06-22T13:35:24.359Z","slug":"GHSA-78vr-q6cf-c7p6","body":"## Overview\n\n### Summary\n\nThe `Order::setPaymentAmount()` method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied 'paymentAmount' parameter directly to float with no lower-bound check. \n\n### Details\n\nWhen the store has 'Allow Partial Payment on Checkout' enabled, a user can submit a payment amount of $0.00 or even a negative value, potentially marking orders as paid without a valid transaction.\n\n<img width=\"690\" height=\"80\" alt=\"image\" src=\"https://github.com/user-attachments/assets/78b653a6-ccae-4ce4-b71b-fc38a7757d73\" />\n\n<img width=\"761\" height=\"200\" alt=\"image\" src=\"https://github.com/user-attachments/assets/665a235f-62c2-45fe-aa41-c3f266881c77\" />\n\n### PoC\n\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n<img width=\"606\" height=\"144\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a04a6de2-7c5f-4837-aed6-58756e246b80\" />\n\n\n### Impact\nOn stores with partial payment enabled, a customer may be able to set an arbitrarily small payment amount. Gateway behavior varies — some will process $0.00 transactions, effectively giving free order fulfillment.\n\n**Remediation**\n\n<img width=\"718\" height=\"98\" alt=\"image\" src=\"https://github.com/user-attachments/assets/aa64b696-9749-45e4-97f6-8d7299cdf1d6\" />\n\n## Affected packages\n\n- `craftcms/commerce >= 5.0.0, <= 5.6.4`\n- `craftcms/commerce >= 4.0.0, <= 4.11.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `craftcms/commerce 5.6.5`\n- `craftcms/commerce 4.11.2`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}