GHSA-78vr-q6cf-c7p6 Craft Commerce: Partial Payment Amount Without Lower Bound Validation

• Packagist craftcms/commerce: >= 5.0.0, < 5.6.5 → fixed in 5.6.5 • Packagist craftcms/commerce: >= 4.0.0, < 4.11.2 → fixed in 4.11.2

Summary The `Order::setPaymentAmount()` method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied 'paymentAmount' parameter directly to float with no lower-bound check. Details When the store has 'Allow Partial Payment on Checkout' enabled, a user can submit a payment amount of $0.00 or even a negative value, potentially marking orders as paid without a valid transaction. PoC _Complete instructions, including specific configuration details, to reproduce the vulnerability._ Impact On stores with partial payment enabled, a customer may be able to set an arbitrarily small payment amount. Gateway behavior varies — some will process $0.00 transactions, effectively giving free order fulfillment. Remediation