Live › vulnerability › CVE-2026-118539
Drupal Commerce Core fails to check authorization on some routes, so a visitor who guesses the URL can reach content they should not see. The sources do not state what data or actions are exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal Commerce Core in the affected version ranges are exposed. The sources do not say which routes or data are reachable, so whether a given store is at risk is unknown.
No product ranges from the sources yet.
drupal/commerce version in composer.lock or with composer show drupal/commerce2.41 on the 2.x line or later than 3.3.13 on the 3.x lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
This page as .md · .json · in your agent: get_signal("CVE-2026-118539")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.