Project:
Project machine name:
commerceDate:
2026-October-28
Vulnerability:
Access bypass
Affected versions:
<2.41 || >=3.0.0 <3.3.13
CVE IDs:
CVE-2026-118539
Description:
This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs.
The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor.
This vulnerability is being actively exploited in the wild.
Solution:
Install the latest version:
- If you use version 3.x, upgrade to Commerce Core 3.3.13.
- If you use an earlier version, upgrade to Commerce Core 8.x-2.41.
Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited.
Fixed By:
- Jonathan Sacksick (jsacksick)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Mohit Aghera (mohit_aghera) provisional member of the Drupal Security Team
- Ryan Szrama (rszrama)
- Tom Ashe (tomtech)
- Jakub Piasecki (zaporylie)
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Vijay Mani (vijaycs85) provisional member of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team
