---
title: Security advisory 2026-11-12
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

## Promotion eligibility issue in commerce

**CVSS**: 6.3\
**Affected versions**: 30.11.0 - 31.10.2\
**Category**: Improper authorization

### Summary

Under specific circumstances, an issue in [digital commerce](https://docs.kentico.com/documentation/developers-and-admins/digital-commerce-setup.md) [order creation](https://docs.kentico.com/documentation/developers-and-admins/digital-commerce-setup/checkout-process/order-creation.md) could cause an order placed by an unauthenticated visitor to be associated with an existing customer linked to a [member](https://docs.kentico.com/documentation/business-users/members.md) account. [Promotions restricted to registered members](https://docs.kentico.com/documentation/developers-and-admins/digital-commerce-setup/promotions.md#customer-eligibility) could be applied without authentication, and the order and the visitor's addresses could be saved to that customer's record.

The issue did not provide access to the member's account or data.

### How to fix

Update to version 31.10.3 or later. See [Update Xperience by Kentico projects](https://docs.kentico.com/documentation/developers-and-admins/installation/update-xperience-by-kentico-projects.md) for detailed instructions.