CVE-2026-118539

Name of the Vulnerable Software and Affected Versions Drupal Commerce Core versions 0.0.0 through 2.41 Drupal Commerce Core versions 3.0.0 through 3.3.13

Description A missing authorization issue allows forceful browsing and access bypass. The flaw stems from insufficient protection of routes and entity fields, enabling unauthenticated attackers to perform privileged actions, manipulate orders, and access customer payment data or personally identifiable information (PII). This issue affects the shopping cart, checkout, and API functionality. It is estimated that over 42,000 deployments are affected. There are confirmed reports of active exploitation in the wild, including instances of fraudulent orders on live websites.

Recommendations Upgrade Drupal Commerce Core versions 0.0.0 through 2.41 to version 8.x-2.41. Upgrade Drupal Commerce Core versions 3.0.0 through 3.3.13 to version 3.3.13. Restrict access to the Commerce module endpoints via WAF rules or reverse proxy ACLs to minimize the risk of exploitation. Audit orders and checkout records for inconsistencies, unauthorized modifications, or unexpected financial outcomes.