{"id":"CVE-2026-118544","kind":"vulnerability","aliases":["CVE-2026-118544"],"related":[],"title":"Drupal Commerce Core: data queries expose sensitive information to forceful browsing","description":"Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","summary":"Drupal Commerce Core has an information exposure flaw in how it handles data queries. An attacker can browse directly to resources they should not reach and read sensitive information.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","drupal-commerce","ecommerce","package","self-hosted"],"not_affected_if":["not-using-commerce-core"],"how_to_check":"- Check the installed Commerce Core version with `composer show drupal/commerce` on the Drupal site\n- Compare the result against the affected ranges: up to `2.41.0` and `3.0.0` through `3.3.13`","fix":"- Move to a Commerce Core release newer than `2.41.0` on the 2.x line, or newer than `3.3.13` on the 3.x line; exact fixed versions unknown from the sources","status":"open","published_at":"2026-10-30T04:18:19+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","triaged_at":"2026-10-30T04:29:33+00:00","updated_at":"2026-10-30T04:29:33+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:33Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Commerce Core release newer than `2.41.0` on the 2.x line, or newer than `3.3.13` on the 3.x line; exact fixed versions unknown from the sources","reach":"internet","title":"Drupal Commerce Core: data queries expose sensitive information to forceful browsing","impact":"medium","summary":"Drupal Commerce Core has an information exposure flaw in how it handles data queries. An attacker can browse directly to resources they should not reach and read sensitive information.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","drupal-commerce","ecommerce","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads sensitive store data without authentication through direct browsing","analyst_note":"Confirm the fixed versions and whether authentication or specific configuration is required; check the NVD entry and the Drupal security advisory.","how_to_check":"- Check the installed Commerce Core version with `composer show drupal/commerce` on the Drupal site\n- Compare the result against the affected ranges: up to `2.41.0` and `3.0.0` through `3.3.13`","plain_action":"","needs_analyst":true,"not_affected_if":["not-using-commerce-core"],"who_is_affected":"Sites running Drupal Commerce Core in the affected version ranges are exposed. The sources do not say which data queries or configurations are needed, so unknown whether default installs are affected. Sites not using Commerce Core can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.0007,"input_tokens":4117,"output_tokens":577,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118544':14A,17A '-2026':13A,16A '0.0.0':78C '2.41.0':80C '3.0.0':82C '3.3.13':84C 'affect':73C 'allow':68C 'attack':42B 'brows':11A,44B,70C 'commerc':2A,21B,28B,66C,74C 'core':3A,29B,67C,75C 'cve':12A,15A 'data':4A,39B,61C 'direct':45B 'drupal':1A,18B,20B,27B,65C 'drupal-commerc':19B 'ecommerc':22B 'expos':6A 'exposur':33B,56C 'flaw':34B 'forc':10A,69C 'handl':38B 'host':26B 'inform':8A,32B,55B,59C 'issu':72C 'packag':23B 'queri':5A,40B,62C 'reach':51B 'read':53B 'resourc':47B 'self':25B 'self-host':24B 'sensit':7A,54B,58C 'version':76C 'vulner':63C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal Commerce Core in the affected version ranges are exposed. The sources do not say which data queries or configurations are needed, so unknown whether default installs are affected. Sites not using Commerce Core can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118544","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118544","severity":null,"published_at":"2026-10-30T04:18:19+00:00","modified_at":"2026-10-30T04:18:19+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","fetched_at":"2026-10-30T04:28:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}