Project:
Project machine name:
commerce_sermepaDate:
2026-November-11
Vulnerability:
Improper authorization
Affected versions:
<2.5.0
CVE IDs:
CVE-2026-126742
Description:
The Commerce sermpea module provides Commerce support for Spanish banks that use Sermepa/Redsys systems.
The module does not verify that a Redsys payment response belongs to the order it is processed for, which can lead to incorrect order payment status.
Solution:
Install the latest version:
- Update to Commerce Sermepa 8.x-2.5.
Reported By:
- Ra Mänd (ram4nd), provisional member of the Drupal Security Team
- Whippet (VenusTech ADLab) (whippet)
Fixed By:
- Manuel Egío (facine)
- Pedro Cambra (pcambra)
- Ra Mänd (ram4nd), provisional member of the Drupal Security Team
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
