Live › vulnerability › CVE-2026-118541
Drupal Commerce Core has an incorrect authorization flaw that lets a user reach pages they should not see by browsing directly to their addresses. The sources do not say what data or actions are exposed beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal Commerce Core in the listed version ranges are affected. The sources do not say which routes or permissions are involved, so whether a given store is exposed is unknown.
No product ranges from the sources yet.
composer.lock or with composer show drupal/commerce2.41.0 on the 2.x line, or newer than 3.3.13 on the 3.x lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
This page as .md · .json · in your agent: get_signal("CVE-2026-118541")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.