Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Drupal Commerce Core allows unauthorized page access

CVE-2026-118542 · published 6 days ago
Summary

Certain versions of Drupal Commerce Core let anyone view pages or data they shouldn't be able to see. This could expose product details or customer information. Update the Commerce Core module to the newest release or apply the vendor’s recommended fix.

What to do
  • Update drupal drupal/commerce to version 3.3.13.
  • Update drupal commerce core to version 2.41.0 or later.
Affected software
Ecosystem VendorProductAffected versions
Packagist:https://packages.drupal.org/8 drupal drupal/commerce >= 3.0.0, < 3.3.13
Fix: upgrade to 3.3.13
– drupal commerce core < 2.41.0
Original advisory text
Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
References
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published30 Oct 2026
Updated30 Oct 2026
First seen28 Oct 2026
Sources
DRUPAL-CONTRIB-2026-257 · OSV
CVE-2026-118542 · NVD
CVE-2026-118542 · MITRE
Track software like this
Free during beta