Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258

This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates.

Routes for the inbox do not check for a CSRF token. As a result, an attacker can trick a user with the "access commerce administration pages" permission into visiting a crafted page that will dismiss notifications for the messages. The inbox is also shared by all users, so if one commerce administrator is tricked, this hides the messages from every administrator, including notices that a security update is available.