{"id":"CVE-2026-118542","kind":"vulnerability","aliases":["CVE-2026-118542"],"related":[],"title":"Drupal Commerce Core: incorrect authorization lets users browse restricted pages","description":"Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","summary":"Drupal Commerce Core has an incorrect authorization flaw that allows forceful browsing, meaning a user can reach pages or resources they should not access by requesting their URLs directly. The sources do not state the data exposed or whether an account is needed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","drupal-commerce","ecommerce","package","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Drupal Commerce version, for example with `drush pm:list --filter=commerce`\n- Look for Commerce Core versions `2.41.0` or earlier, or `3.0.0` through `3.3.13`","fix":"- Drupal Commerce Core: move to a version later than `2.41.0` on the 2.x line, or later than `3.3.13` on the 3.x line (the sources give these ranges; the exact fixed release is unknown)","status":"open","published_at":"2026-10-30T04:18:19+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","triaged_at":"2026-10-30T04:29:36+00:00","updated_at":"2026-10-30T04:29:36+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:36Z","model":"claude-haiku-5-5","output":{"fix":"- Drupal Commerce Core: move to a version later than `2.41.0` on the 2.x line, or later than `3.3.13` on the 3.x line (the sources give these ranges; the exact fixed release is unknown)","reach":"internet","title":"Drupal Commerce Core: incorrect authorization lets users browse restricted pages","impact":"medium","summary":"Drupal Commerce Core has an incorrect authorization flaw that allows forceful browsing, meaning a user can reach pages or resources they should not access by requesting their URLs directly. The sources do not state the data exposed or whether an account is needed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","drupal-commerce","ecommerce","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted commerce pages or data","analyst_note":"Check the NVD entry and the Drupal security advisory for the exact fixed version, the affected pages, and whether authentication is required.","how_to_check":"- Check the installed Drupal Commerce version, for example with `drush pm:list --filter=commerce`\n- Look for Commerce Core versions `2.41.0` or earlier, or `3.0.0` through `3.3.13`","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sites running Drupal Commerce Core in the affected version ranges are exposed. The sources do not say which pages or roles are involved, so teams should confirm whether their store exposes admin or customer-only URLs before deciding urgency.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000711,"input_tokens":4097,"output_tokens":602,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118542':13A,16A '-2026':12A,15A '0.0.0':86C '2.41.0':88C '3.0.0':90C '3.3.13':92C 'access':49B 'account':66B 'affect':81C 'allow':35B,76C 'author':5A,32B,70C 'brows':8A,37B,78C 'commerc':2A,20B,27B,74C,82C 'core':3A,28B,75C,83C 'cve':11A,14A 'data':61B 'direct':54B 'drupal':1A,17B,19B,26B,73C 'drupal-commerc':18B 'ecommerc':21B 'expos':62B 'flaw':33B 'forc':36B,77C 'host':25B 'incorrect':4A,31B,69C 'issu':80C 'let':6A 'mean':38B 'need':68B 'packag':22B 'page':10A,43B 'reach':42B 'request':51B 'resourc':45B 'restrict':9A 'self':24B 'self-host':23B 'sourc':56B 'state':59B 'url':53B 'user':7A,40B 'version':84C 'vulner':71C 'whether':64B","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal Commerce Core in the affected version ranges are exposed. The sources do not say which pages or roles are involved, so teams should confirm whether their store exposes admin or customer-only URLs before deciding urgency.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118542","severity":null,"published_at":"2026-10-30T04:18:19+00:00","modified_at":"2026-10-30T04:18:19+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","fetched_at":"2026-10-30T04:28:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}