PT-2026-76589 · Drupal+2 · Commerce Paypal+1

Benji Fisher

+8

·

CVE-2026-73475

·

Published

2026-08-12

·

Updated

2026-09-02

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Commerce PayPal versions 0.0.0 through 1.12.0 Commerce PayPal versions 2.0.0 through 2.1.3
Description An incorrect authorization issue allows forceful browsing. The module fails to sufficiently validate transaction results when using the Payflow Link payment gateway, which enables a malicious user to mark transactions as completed without providing payment.
Recommendations Update Commerce PayPal versions 0.0.0 through 1.12.0 to a version newer than 1.12.0. Update Commerce PayPal versions 2.0.0 through 2.1.3 to a version newer than 2.1.3.

Exploit

Fix

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-73475
DRUPAL-CONTRIB-2026-095

Affected Products

Commerce Paypal
Drupal/Commerce Paypal