Attackers exploit critical Drupal Commerce Core flaw CVE-2026-118539
Original title: Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539
Missing checks on routes and entity fields affect Commerce Core through 2.41 and 3.3.13 and may cost vendors money.
Drupal says attackers are exploiting CVE-2026-118539, a missing-authorization bug in Commerce Core, the module online stores use for carts, checkout, and APIs. Forceful browsing can reach insufficiently protected routes and entity fields. Maintainers confirmed active exploitation. Sites on 3.x should move to 3.3.13, and earlier releases to 8.x-2.41. Dan Puccetti, Marcus Johansson, and Robert Snyder reported the flaw.
Unconfirmed: No specific victim stores are named; financial harm is described as possible.
- The advisory lists affected versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.
- Drupal says the access bypass may financially impact the vendor.
- Project maintainers confirmed the flaw is being exploited.
- Recommended upgrades are Commerce Core 3.3.13 and 8.x-2.41.
Impact: Access bypass that may financially impact the vendor
| Product | Affected | Fixed in |
|---|---|---|
| Drupal Commerce Core | from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13 | 3.3.13 and 8.x-2.41 |
- 1.Upgrade Commerce Core 3.x installations to version 3.3.13.
- 2.Move earlier releases to Commerce Core 8.x-2.41.
- CVEs
- CVE-2026-118539
- Vendors
- Drupal
- Products
- Commerce Core
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-118539 | Missing authorization in Drupal Commerce Core | 6.5 | — |
From the original article
1 min read at securityaffairs.com
Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk. Drupal warns that threat actors are exploiting a highly critical security flaw, tracked as CVE-2026-118539, in its Commerce Core module. The vulnerability is caused by missing authorization checks.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.