Drupal Commerce Core access bypass exploited in attacks
Original title: Drupal warns of critical Commerce Core flaw exploited in attacks
Unauthenticated attackers can bypass route and field protections on more than 42,000 sites and may cause financial loss.
Drupal warned administrators that a critical missing-authorization flaw in the Commerce Core module, CVE-2026-118539, is being exploited. It affects versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13 and can be abused without authentication. Drupal asked 3.x admins to upgrade immediately to 3.3.13, or to 8.x-2.41 on earlier branches, and to audit orders for inconsistencies. The module is used by more than 42,000 websites, including Fortune 500 companies and research universities.
- Drupal tagged the Wednesday advisory highly critical.
- Insufficient protection of certain routes and entity fields causes the access bypass.
- Commerce Core supports shopping carts, checkout, and API-based decoupled storefronts.
- Drupal separately recalled exploited SQL injection CVE-2026-9082 and two later RCE fixes.
Impact: Unauthenticated access bypass that may financially harm the vendor
| Product | Affected | Fixed in |
|---|---|---|
| Drupal Commerce Core | 0.0.0 through 2.41 and 3.0.0 through 3.3.13 | 3.3.13 or 8.x-2.41 |
- 1.Upgrade 3.x to Commerce Core 3.3.13, or earlier branches to 8.x-2.41.
- 2.Audit orders for inconsistencies.
- CVEs
- CVE-2026-118539
- Vendors
- Drupal
- Products
- Commerce Core
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-118539 | Missing authorization in Drupal Commerce Core | 6.5 | — |
From the original article
2 min read at bleepingcomputer.com
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.