Live › vulnerability › CVE-2026-118542
Drupal Commerce Core has an incorrect authorization flaw that allows forceful browsing, meaning a user can reach pages or resources they should not access by requesting their URLs directly. The sources do not state the data exposed or whether an account is needed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal Commerce Core in the affected version ranges are exposed. The sources do not say which pages or roles are involved, so teams should confirm whether their store exposes admin or customer-only URLs before deciding urgency.
No product ranges from the sources yet.
drush pm:list --filter=commerce2.41.0 or earlier, or 3.0.0 through 3.3.132.41.0 on the 2.x line, or later than 3.3.13 on the 3.x line (the sources give these ranges; the exact fixed release is unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
This page as .md · .json · in your agent: get_signal("CVE-2026-118542")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.