CVE-2026-118539

Name of the Vulnerable Software and Affected Versions Drupal Commerce Core versions 0.0.0 through 2.41 Drupal Commerce Core versions 3.0.0 through 3.3.13

Description An access bypass issue exists because the module does not sufficiently protect certain routes and entity fields, allowing for forceful browsing. This flaw may result in financial impact for the vendor and is being actively exploited in the wild.

Recommendations Update Drupal Commerce Core versions 0.0.0 through 2.41 to a version newer than 2.41. Update Drupal Commerce Core versions 3.0.0 through 3.3.13 to a version newer than 3.3.13.