{"id":"CVE-2026-118540","kind":"vulnerability","aliases":["CVE-2026-118540"],"related":[],"title":"Drupal Commerce Core: incorrect authorization lets users browse restricted pages","description":"Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.","summary":"Drupal Commerce Core has an incorrect authorization flaw that allows forceful browsing, meaning a user can reach pages or resources they should not access by requesting them directly. The sources do not state what data or actions are exposed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","drupal-commerce","package","php"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed Commerce Core version in `composer show drupal/commerce` and see whether it falls in 0.0.0 to 2.41 or 3.0.0 to 3.2.0.","fix":"- Move Drupal Commerce Core past the affected ranges (fixed version not stated in the sources)","status":"open","published_at":"2026-10-30T04:18:18+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","triaged_at":"2026-10-30T04:29:37+00:00","updated_at":"2026-10-30T04:29:37+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:37Z","model":"claude-haiku-5-5","output":{"fix":"- Move Drupal Commerce Core past the affected ranges (fixed version not stated in the sources)","reach":"internet","title":"Drupal Commerce Core: incorrect authorization lets users browse restricted pages","impact":"medium","summary":"Drupal Commerce Core has an incorrect authorization flaw that allows forceful browsing, meaning a user can reach pages or resources they should not access by requesting them directly. The sources do not state what data or actions are exposed.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","drupal-commerce","php"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown data or actions reachable by direct URL requests","analyst_note":"Find the Drupal security advisory for Commerce Core to confirm the fixed version, the affected pages, and the required permissions.","how_to_check":"- Check the installed Commerce Core version in `composer show drupal/commerce` and see whether it falls in 0.0.0 to 2.41 or 3.0.0 to 3.2.0.\n- unknown beyond the version range","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Sites running Drupal Commerce Core in the affected version ranges may expose restricted pages to users who request them directly. The sources do not describe the exact configuration or role required, so the exposure scope is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000679,"input_tokens":4095,"output_tokens":540,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118540':13A,16A '-2026':12A,15A '0.0.0':79C '2.41':81C '3.0.0':83C '3.2.0':85C 'access':46B 'action':59B 'affect':74C 'allow':32B,69C 'author':5A,29B,63C 'brows':8A,34B,71C 'commerc':2A,20B,24B,67C,75C 'core':3A,25B,68C,76C 'cve':11A,14A 'data':57B 'direct':50B 'drupal':1A,17B,19B,23B,66C 'drupal-commerc':18B 'expos':61B 'flaw':30B 'forc':33B,70C 'incorrect':4A,28B,62C 'issu':73C 'let':6A 'mean':35B 'packag':21B 'page':10A,40B 'php':22B 'reach':39B 'request':48B 'resourc':42B 'restrict':9A 'sourc':52B 'state':55B 'user':7A,37B 'version':77C 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal Commerce Core in the affected version ranges may expose restricted pages to users who request them directly. The sources do not describe the exact configuration or role required, so the exposure scope is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:18:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118540","severity":null,"published_at":"2026-10-30T04:18:18+00:00","modified_at":"2026-10-30T04:18:18+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","fetched_at":"2026-10-30T04:28:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}