CVE-2026-118541

Name of the Vulnerable Software and Affected Versions Drupal Commerce Core versions 0.0.0 through 2.41.0 Drupal Commerce Core versions 3.0.0 through 3.3.13

Description An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify access to the relationship between promotions and coupons. Consequently, a user authorized only to manage their own promotions can modify or delete coupons associated with other promotions. This issue is mitigated if the site does not enable writes through JSON:API or REST, as these are disabled by default.

Recommendations Update Drupal Commerce Core versions 0.0.0 through 2.41.0 to a version newer than 2.41.0. Update Drupal Commerce Core versions 3.0.0 through 3.3.13 to a version newer than 3.3.13. Disable writes through JSON:API or REST to mitigate the risk.