CVE-2026-118540

Name of the Vulnerable Software and Affected Versions Drupal Commerce Core versions 0.0.0 through 2.41 Drupal Commerce Core versions 3.0.0 through 3.2.0

Description An incorrect authorization issue allows forceful browsing when Drupal Commerce is used in conjunction with the JSON:API module. This allows users without proper permissions to access unpublished product variations. This issue specifically affects sites that maintain both published products and unpublished product variations.

Recommendations Update Drupal Commerce Core versions 0.0.0 through 2.41 to a version newer than 2.41. Update Drupal Commerce Core versions 3.0.0 through 3.2.0 to a version newer than 3.2.0.