What is GHSA-78vr-q6cf-c7p6?

GHSA-78vr-q6cf-c7p6 is a security advisory published by GitHub Security Advisories with Medium severity. Craft Commerce: Partial Payment Amount Without Lower Bound Validation

Why does GHSA-78vr-q6cf-c7p6 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-78vr-q6cf-c7p6?

GHSA-78vr-q6cf-c7p6 affects 2 products, including: composer/craftcms/commerce:\u003e= 5.0.0, \u003c= 5.6.4; composer/craftcms/commerce:\u003e= 4.0.0, \u003c= 4.11.1.

GHSA-78vr-q6cf-c7p6MediumDisclosed before NVD

Craft Commerce: Partial Payment Amount Without Lower Bound Validation

Vendor

GitHub Security Advisories

Published

June 19, 2026

Last Modified

June 19, 2026

📋 Description

Summary

The Order::setPaymentAmount() method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied 'paymentAmount' parameter directly to float with no lower-bound check.

Details

When the store has 'Allow Partial Payment on Checkout' enabled, a user can submit a payment amount of $0.00 or even a negative value, potentially marking orders as paid without a valid transaction.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

Impact

On stores with partial payment enabled, a customer may be able to set an arbitrarily small payment amount. Gateway behavior varies — some will process $0.00 transactions, effectively giving free order fulfillment.

Remediation

🎯 Affected products2

composer/craftcms/commerce:>= 5.0.0, <= 5.6.4
composer/craftcms/commerce:>= 4.0.0, <= 4.11.1

📋 Description

Summary

Details

PoC

Impact

🎯 Affected products2

🔗 References (3)