Live › vulnerability › CVE-2026-118544
Drupal Commerce Core has an information exposure flaw in how it handles data queries. An attacker can browse directly to resources they should not reach and read sensitive information.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal Commerce Core in the affected version ranges are exposed. The sources do not say which data queries or configurations are needed, so unknown whether default installs are affected. Sites not using Commerce Core can skip it.
No product ranges from the sources yet.
composer show drupal/commerce on the Drupal site2.41.0 and 3.0.0 through 3.3.132.41.0 on the 2.x line, or newer than 3.3.13 on the 3.x line; exact fixed versions unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
This page as .md · .json · in your agent: get_signal("CVE-2026-118544")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.