Project: 
Commerce Escrow
Project machine name: 
commerce_escrow
Date: 
2026-November-04
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability: 
Access bypass
Affected versions: 
<1.1.0
CVE IDs: 
CVE-2026-122071
Description: 

This module enables you to accept payments through Escrow.com with Drupal Commerce.

The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are in progress.

Solution: 

Install the latest version:

After updating, register the new webhook URL with Escrow.com. It is shown on the configuration form of each Escrow payment gateway.

Reported By: 
Fixed By: 
Coordinated By: