---
id: "CVE-2026-118544"
kind: "vulnerability"
aliases: ["CVE-2026-118544"]
title: "Drupal Commerce Core: data queries expose sensitive information to forceful browsing"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "drupal-commerce", "ecommerce", "package", "self-hosted"]
not_affected_if: ["not-using-commerce-core"]
published_at: "2026-10-30T04:18:19+00:00"
first_seen_at: "2026-10-30T04:28:38+00:00"
updated_at: "2026-10-30T04:29:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118544", "first_seen_at": "2026-10-30T04:28:38+00:00"}]
---

# Drupal Commerce Core: data queries expose sensitive information to forceful browsing

Drupal Commerce Core has an information exposure flaw in how it handles data queries. An attacker can browse directly to resources they should not reach and read sensitive information.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Commerce Core version with `composer show drupal/commerce` on the Drupal site
- Compare the result against the affected ranges: up to `2.41.0` and `3.0.0` through `3.3.13`

## Fix

- Move to a Commerce Core release newer than `2.41.0` on the 2.x line, or newer than `3.3.13` on the 3.x line; exact fixed versions unknown from the sources

## Timeline

- 2026-10-30T04:28:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118544

## From the sources

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_