{"id":"CVE-2026-118556","kind":"vulnerability","aliases":["CVE-2026-118556"],"related":[],"title":"Drupal Commerce Shipping: incorrect authorization allows forceful browsing","description":"Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.","summary":"Drupal Commerce Shipping has an authorization flaw that lets a user reach pages or resources they should not be able to open by browsing directly to their addresses. The sources do not say what data or actions are exposed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","drupal-commerce","ecommerce","package"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed Commerce Shipping version with `drush pm:list --filter=commerce_shipping` or in `composer.lock`\n- Compare the result against the affected ranges: `2.16.0` and earlier, and `3.0.0` through `3.0.6`","fix":"- Commerce Shipping: move to a version later than `2.16.0` on the 2.x line, or later than `3.0.6` on the 3.x line (the sources give no exact fixed version)","status":"open","published_at":"2026-10-30T04:18:21+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","triaged_at":"2026-10-30T04:29:21+00:00","updated_at":"2026-10-30T04:29:21+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:21Z","model":"claude-haiku-5-5","output":{"fix":"- Commerce Shipping: move to a version later than `2.16.0` on the 2.x line, or later than `3.0.6` on the 3.x line (the sources give no exact fixed version)","reach":"internet","title":"Drupal Commerce Shipping: incorrect authorization allows forceful browsing","impact":"medium","summary":"Drupal Commerce Shipping has an authorization flaw that lets a user reach pages or resources they should not be able to open by browsing directly to their addresses. The sources do not say what data or actions are exposed.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","drupal-commerce","ecommerce"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; unauthorized pages or data may be reachable","analyst_note":"Check the NVD entry and the Drupal security advisory for the affected pages, required privileges and the fixed release.","how_to_check":"- Check the installed Commerce Shipping version with `drush pm:list --filter=commerce_shipping` or in `composer.lock`\n- Compare the result against the affected ranges: `2.16.0` and earlier, and `3.0.0` through `3.0.6`\n- unknown for any other check","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Sites running Drupal Commerce with the Commerce Shipping module in the affected version ranges are exposed. The sources do not say which pages or roles are reachable, so unknown whether anonymous visitors can reach them.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000705,"input_tokens":4103,"output_tokens":590,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118556':11A,14A '-2026':10A,13A '0.0.0':77C '2.16.0':79C '3.0.0':81C '3.0.6':83C 'abl':40B 'action':57B 'address':48B 'affect':72C 'allow':6A,67C 'author':5A,26B,61C 'brows':8A,44B,69C 'commerc':2A,18B,22B,65C,73C 'cve':9A,12A 'data':55B 'direct':45B 'drupal':1A,15B,17B,21B,64C 'drupal-commerc':16B 'ecommerc':19B 'expos':59B 'flaw':27B 'forc':7A,68C 'incorrect':4A,60C 'issu':71C 'let':29B 'open':42B 'packag':20B 'page':33B 'reach':32B 'resourc':35B 'say':53B 'ship':3A,23B,66C,74C 'sourc':50B 'user':31B 'version':75C 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal Commerce with the Commerce Shipping module in the affected version ranges are exposed. The sources do not say which pages or roles are reachable, so unknown whether anonymous visitors can reach them.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118556","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118556","severity":null,"published_at":"2026-10-30T04:18:21+00:00","modified_at":"2026-10-30T04:18:21+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","fetched_at":"2026-10-30T04:28:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}