CVE-2026-118542

Name of the Vulnerable Software and Affected Versions Drupal Commerce Core versions 0.0.0 through 2.41.0 Drupal Commerce Core versions 3.0.0 through 3.3.13

Description An incorrect authorization issue allows forceful browsing when a store is saved. The system fails to properly verify access permissions, enabling a user with the ability to create stores or edit their own store to mark it as the site's default store. This allows the user to receive orders they are not authorized to access. This issue primarily impacts sites that grant these permissions to untrusted users, such as marketplace platforms where vendors manage their own stores.

Recommendations Update Drupal Commerce Core versions 0.0.0 through 2.41.0 to a version newer than 2.41.0. Update Drupal Commerce Core versions 3.0.0 through 3.3.13 to a version newer than 3.3.13. Restrict permissions to create or edit stores to trusted users only.