CVE-2026-13238

Name of the Vulnerable Software and Affected Versions Drupal Commerce Realex / Global Payments versions 0.0.0 through 3.0.2

Description An incorrect authorization issue allows forceful browsing when the gateway is configured with the redirect payment method. The module fails to sufficiently verify the authenticity of the payment response returned by Global Payments. This specifically affects the redirect payment method, while the lightbox method, which validates the signature, remains unaffected.

Recommendations Update Drupal Commerce Realex / Global Payments to a version later than 3.0.2. As a temporary mitigation, avoid using the redirect payment method and use the lightbox payment method instead.