Loading vulnerability…
Missing Authorization in Drupal Commerce Core
CVE-2026-118539 is a missing-authorization vulnerability in Drupal Commerce Core. Insufficient access checks on certain routes and entity fields allow unauthenticated attackers to bypass authorization restrictions through direct requests to protected functionality. Exploitation can expose private information and permit unauthorized data changes, potentially causing financial harm to merchants. Drupal rates the vulnerability highly critical at 21/25 on its security scale and confirms active exploitation. Most advisories identify affected versions as releases before 2.41 and 3.x releases before 3.3.13, although published version boundaries contain inconsistencies. The specific vulnerable functions and complete exploitation mechanism have not been publicly disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality and integrity of commerce data and cause financial losses. Potential consequences include unauthorized access to order and payment functionality and manipulation of transaction-related data. Changes to totals, pricing, coupons, or payment states are reported possibilities, but the precise modifiable fields and observed attack actions have not been disclosed. Remote code execution and full website takeover are not established consequences of this vulnerability.
If you can’t patch tonight, do this now.
No temporary workaround is specified. Prioritize upgrading because exploitation is ongoing. Audit orders for inconsistencies by comparing recorded orders with expected prices and payment records, and investigate unexplained differences. Retrospective transaction review helps identify potential exploitation but does not prevent further access bypass.
Patch, then assume compromise.
Upgrade the Commerce Core module immediately to version 3.3.13 or later on the 3.x branch, or 8.x-2.41 or later on the 2.x branch, following Drupal advisory SA-CONTRIB-2026-254. Confirm the installed Commerce package version rather than assuming a Drupal core update addresses the issue. Published affected-version ranges are inconsistent, but these releases are explicitly recommended as fixes. After updating, audit orders and investigate suspicious transactions from the exposure period; patching does not reverse prior unauthorized changes.
No public exploits tracked yet. Mallory keeps watching.
38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.