{"id":"CVE-2026-118539","kind":"vulnerability","aliases":["CVE-2026-118539"],"related":[],"title":"Drupal Commerce Core: missing access check exposes pages to forceful browsing","description":"Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.","summary":"Drupal Commerce Core fails to check authorization on some routes, so a visitor who guesses the URL can reach content they should not see. The sources do not state what data or actions are exposed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","drupal-commerce","ecommerce","package","php"],"not_affected_if":["not-using-drupal-commerce"],"how_to_check":"- Check the installed `drupal/commerce` version in composer.lock or with `composer show drupal/commerce`","fix":"- Move Drupal Commerce Core to a version later than `2.41` on the 2.x line or later than `3.3.13` on the 3.x line\n- Exact fixed versions: unknown","status":"open","published_at":"2026-10-30T04:18:18+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","triaged_at":"2026-10-30T04:29:39+00:00","updated_at":"2026-10-30T04:29:39+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:39Z","model":"claude-haiku-5-5","output":{"fix":"- Move Drupal Commerce Core to a version later than `2.41` on the 2.x line or later than `3.3.13` on the 3.x line\n- Exact fixed versions: unknown","reach":"internet","title":"Drupal Commerce Core: missing access check exposes pages to forceful browsing","impact":"medium","summary":"Drupal Commerce Core fails to check authorization on some routes, so a visitor who guesses the URL can reach content they should not see. The sources do not state what data or actions are exposed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","drupal-commerce","php","ecommerce"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized visitors read or act on restricted store pages","analyst_note":"Find the NVD or Drupal security advisory text to identify affected routes, required privileges, and the fixed release numbers.","how_to_check":"- Check the installed `drupal/commerce` version in composer.lock or with `composer show drupal/commerce`\n- unknown for which routes are affected","plain_action":"","needs_analyst":true,"not_affected_if":["not-using-drupal-commerce"],"who_is_affected":"Sites running Drupal Commerce Core in the affected version ranges are exposed. The sources do not say which routes or data are reachable, so whether a given store is at risk is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":4091,"output_tokens":529,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118539':14A,17A '-2026':13A,16A '0.0.0':77C '2.41':79C '3.0.0':81C '3.3.13':83C 'access':5A 'action':57B 'affect':72C 'allow':67C 'author':31B,61C 'brows':11A,69C 'check':6A,30B 'commerc':2A,21B,26B,65C,73C 'content':44B 'core':3A,27B,66C,74C 'cve':12A,15A 'data':55B 'drupal':1A,18B,20B,25B,64C 'drupal-commerc':19B 'ecommerc':22B 'expos':7A,59B 'fail':28B 'forc':10A,68C 'guess':39B 'issu':71C 'miss':4A,60C 'packag':23B 'page':8A 'php':24B 'reach':43B 'rout':34B 'see':48B 'sourc':50B 'state':53B 'url':41B 'version':75C 'visitor':37B 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal Commerce Core in the affected version ranges are exposed. The sources do not say which routes or data are reachable, so whether a given store is at risk is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118539","severity":null,"published_at":"2026-10-30T04:18:18+00:00","modified_at":"2026-10-30T04:18:18+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","fetched_at":"2026-10-30T04:28:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}