Drupal warned of a highly critical access-bypass vulnerability in its Commerce Core module, tracked as CVE-2026-118539. The missing-authorization flaw insufficiently protects certain routes and entity fields and could allow unauthorized actions with financial consequences for store operators. It affects Commerce Core releases before 8.x-2.41 and 3.3.13, while those versions contain the fixes. Drupal said the vulnerability was being actively exploited and advised administrators to upgrade immediately and audit orders for inconsistencies. Commerce Core provides shopping-cart and checkout functionality for Drupal stores, including sites using decoupled applications and APIs.
Why it matters
Organizations running vulnerable Drupal Commerce Core releases may face unauthorized manipulation of commerce data or fraudulent orders. Administrators should upgrade to 8.x-2.41 or 3.3.13 as appropriate, investigate order records, and review their sites for suspicious activity.
Key points
- CVE-2026-118539 affects Drupal Commerce Core.
- The vulnerability is a CWE-862 missing-authorization flaw that causes an access bypass.
- Affected releases are older than Commerce Core 8.x-2.41 and older than Commerce Core 3.3.13.
- Drupal recommends upgrading immediately and auditing orders for inconsistencies.
- Drupal reported active exploitation; maintainers said attempted fraudulent orders had been observed on live sites, without evidence that the activity had spread beyond the initially reported sites.
Based on reporting by The original announcement, The Hacker News and BleepingComputer.
Join the conversation! Your thoughts help the community grow.