CVE-2026-118543

Name of the Vulnerable Software and Affected Versions Drupal Commerce Core versions 0.0.0 through 2.41.0 Drupal Commerce Core versions 3.0.0 through 3.3.13

Description Cross-Site Request Forgery (CSRF) occurs when a user is tricked into performing an action they did not intend to do. In this case, routes for the inbox do not verify CSRF tokens. An attacker can deceive a user with the "access commerce administration pages" permission into visiting a malicious page that dismisses notifications. Because the inbox is shared, this action hides messages, including security update notices, from all administrators.

Recommendations Update Drupal Commerce Core versions 0.0.0 through 2.41.0 to a version newer than 2.41.0. Update Drupal Commerce Core versions 3.0.0 through 3.3.13 to a version newer than 3.3.13.