CVE-2026-118557

Name of the Vulnerable Software and Affected Versions Drupal Commerce Shipping versions 0.0.0 through 2.16.0 Drupal Commerce Shipping versions 3.0.0 through 3.0.6

Description An incorrect authorization issue exists in the module used for organizing tangible products into shipments for fulfillment. The system fails to sufficiently verify access permissions on the form used to resend receipts. Under specific configurations, this allows unauthorized users to perform forceful browsing to access receipts and sensitive customer information for orders they are not permitted to view.

Recommendations Update Drupal Commerce Shipping versions 0.0.0 through 2.16.0 to a version newer than 2.16.0. Update Drupal Commerce Shipping versions 3.0.0 through 3.0.6 to a version newer than 3.0.6.