CVE-2026-118556

Name of the Vulnerable Software and Affected Versions Drupal Commerce Shipping versions 0.0.0 through 2.16.0 Drupal Commerce Shipping versions 3.0.0 through 3.0.6

Description An incorrect authorization issue allows forceful browsing within the module used for organizing tangible products into shipments for fulfillment. The module fails to sufficiently protect shipment references and shipment entity fields, leading to an access bypass. This can result in the unauthorized modification of shipment states or the deletion of shipments. Exploitation requires the attacker to possess a cart with API-based access to manipulate shipments.

Recommendations Update Drupal Commerce Shipping versions 0.0.0 through 2.16.0 to a version newer than 2.16.0. Update Drupal Commerce Shipping versions 3.0.0 through 3.0.6 to a version newer than 3.0.6.