{"id":"CVE-2026-118557","kind":"vulnerability","aliases":["CVE-2026-118557"],"related":[],"title":"Drupal Commerce Shipping: incorrect authorization allows forceful browsing","description":"Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.","summary":"Drupal Commerce Shipping has an incorrect authorization check that lets a user reach pages or resources they should not be able to open by browsing directly to their addresses. The sources do not state what data or actions an attacker gets beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","drupal-commerce","ecommerce","package","php"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed Commerce Shipping version with `composer show drupal/commerce_shipping` and compare it with the affected ranges.","fix":"- Commerce Shipping versions from 0.0.0 to 2.16.0 and from 3.0.0 to 3.0.6 are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-10-30T04:18:21+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","triaged_at":"2026-10-30T04:29:20+00:00","updated_at":"2026-10-30T04:29:20+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:29:20Z","model":"claude-haiku-5-5","output":{"fix":"- Commerce Shipping versions from 0.0.0 to 2.16.0 and from 3.0.0 to 3.0.6 are affected; the sources do not name a fixed version.","reach":"internet","title":"Drupal Commerce Shipping: incorrect authorization allows forceful browsing","impact":"medium","summary":"Drupal Commerce Shipping has an incorrect authorization check that lets a user reach pages or resources they should not be able to open by browsing directly to their addresses. The sources do not state what data or actions an attacker gets beyond that.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","drupal-commerce","ecommerce","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Find the Drupal security advisory for CVE-2026-118557 to confirm the fixed version, required privileges and what data is exposed.","how_to_check":"- Check the installed Commerce Shipping version with `composer show drupal/commerce_shipping` and compare it with the affected ranges.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Sites running Drupal Commerce with the Commerce Shipping module in the affected version ranges are in scope. The sources do not say which configurations or roles are required, so unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000675,"input_tokens":4103,"output_tokens":530,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118557':11A,14A '-2026':10A,13A '0.0.0':81C '2.16.0':83C '3.0.0':85C '3.0.6':87C 'abl':42B 'action':59B 'address':50B 'affect':76C 'allow':6A,71C 'attack':61B 'author':5A,28B,65C 'beyond':63B 'brows':8A,46B,73C 'check':29B 'commerc':2A,18B,23B,69C,77C 'cve':9A,12A 'data':57B 'direct':47B 'drupal':1A,15B,17B,22B,68C 'drupal-commerc':16B 'ecommerc':19B 'forc':7A,72C 'get':62B 'incorrect':4A,27B,64C 'issu':75C 'let':31B 'open':44B 'packag':20B 'page':35B 'php':21B 'reach':34B 'resourc':37B 'ship':3A,24B,70C,78C 'sourc':52B 'state':55B 'user':33B 'version':79C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Sites running Drupal Commerce with the Commerce Shipping module in the affected version ranges are in scope. The sources do not say which configurations or roles are required, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118557","severity":null,"published_at":"2026-10-30T04:18:21+00:00","modified_at":"2026-10-30T04:18:21+00:00","first_seen_at":"2026-10-30T04:28:38+00:00","fetched_at":"2026-10-30T04:28:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}