{"id":"CVE-2026-118543","kind":"vulnerability","aliases":["CVE-2026-118543"],"related":[],"title":"Drupal Commerce Core: CSRF flaw lets forged requests act as users","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","summary":"Drupal Commerce Core, the e-commerce module for Drupal, has a cross-site request forgery flaw. A malicious web page could trick a logged-in user's browser into sending requests the store would accept as that user.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","drupal-commerce","e-commerce","package"],"not_affected_if":["version-above-affected-range"],"how_to_check":"- Check the installed Commerce Core version with `composer show drupal/commerce`\n- Confirm the version is outside the affected ranges: 0.0.0 to 2.41.0, or 3.0.0 to 3.3.13","fix":"- Move to a Commerce Core release newer than the affected ranges (2.41.0 and 3.3.13 are the last affected versions; the fixed release is unknown)","status":"open","published_at":"2026-10-30T04:18:19+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","triaged_at":"2026-10-30T04:29:35+00:00","updated_at":"2026-10-30T04:29:35+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:35Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Commerce Core release newer than the affected ranges (2.41.0 and 3.3.13 are the last affected versions; the fixed release is unknown)","reach":"internet","title":"Drupal Commerce Core: CSRF flaw lets forged requests act as users","impact":"medium","summary":"Drupal Commerce Core, the e-commerce module for Drupal, has a cross-site request forgery flaw. A malicious web page could trick a logged-in user's browser into sending requests the store would accept as that user.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","drupal-commerce","e-commerce"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"logged-in user's store actions performed without consent","analyst_note":"Find the fixed Commerce Core release and the affected endpoints or forms in the Drupal security advisory; the NVD entry gives no fix or details.","how_to_check":"- Check the installed Commerce Core version with `composer show drupal/commerce`\n- Confirm the version is outside the affected ranges: 0.0.0 to 2.41.0, or 3.0.0 to 3.3.13","plain_action":"","needs_analyst":true,"not_affected_if":["version-above-affected-range"],"who_is_affected":"Sites running Drupal Commerce Core in the affected version ranges are exposed. The sources do not say which Commerce features or endpoints carry the forgeable requests, so unknown whether every store is equally exposed. Sites on versions above 2.41.0 in the 2.x line and above 3.3.13 in the 3.x line are outside the stated range.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000721,"input_tokens":4121,"output_tokens":617,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118543':14A,17A '-2026':13A,16A '0.0.0':90C '2.41.0':92C '3.0.0':94C '3.3.13':96C 'accept':63B 'act':9A 'affect':85C 'allow':78C 'browser':56B 'commerc':2A,21B,24B,27B,32B,76C,86C 'core':3A,28B,77C,87C 'could':48B 'cross':39B,68C,79C 'cross-sit':38B,67C 'csrf':4A,72C 'cve':12A,15A 'drupal':1A,18B,20B,26B,35B,75C 'drupal-commerc':19B 'e':23B,31B 'e-commerc':22B,30B 'flaw':5A,43B 'forg':7A 'forgeri':42B,71C,82C 'issu':84C 'let':6A 'log':52B 'logged-in':51B 'malici':45B 'modul':33B 'packag':25B 'page':47B 'request':8A,41B,59B,70C,81C 'send':58B 'site':40B,69C,80C 'store':61B 'trick':49B 'user':11A,54B,66B 'version':88C 'vulner':73C 'web':46B 'would':62B","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal Commerce Core in the affected version ranges are exposed. The sources do not say which Commerce features or endpoints carry the forgeable requests, so unknown whether every store is equally exposed. Sites on versions above 2.41.0 in the 2.x line and above 3.3.13 in the 3.x line are outside the stated range.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118543","severity":null,"published_at":"2026-10-30T04:18:19+00:00","modified_at":"2026-10-30T04:18:19+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","fetched_at":"2026-10-30T04:28:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}