Live › vulnerability › CVE-2026-118556
Drupal Commerce Shipping has an authorization flaw that lets a user reach pages or resources they should not be able to open by browsing directly to their addresses. The sources do not say what data or actions are exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running Drupal Commerce with the Commerce Shipping module in the affected version ranges are exposed. The sources do not say which pages or roles are reachable, so unknown whether anonymous visitors can reach them.
No product ranges from the sources yet.
drush pm:list --filter=commerce_shipping or in composer.lock2.16.0 and earlier, and 3.0.0 through 3.0.62.16.0 on the 2.x line, or later than on the 3.x line (the sources give no exact fixed version)3.0.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-118556")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.