Live › vulnerability › CVE-2026-118540
Drupal Commerce Core has an incorrect authorization flaw that allows forceful browsing, meaning a user can reach pages or resources they should not access by requesting them directly. The sources do not state what data or actions are exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal Commerce Core in the affected version ranges may expose restricted pages to users who request them directly. The sources do not describe the exact configuration or role required, so the exposure scope is unknown.
No product ranges from the sources yet.
composer show drupal/commerce and see whether it falls in 0.0.0 to 2.41 or 3.0.0 to 3.2.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-118540")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.