Missing Authorization Vulnerability in Drupal Commerce Core by Drupal
CVE-2026-118539

6.5MEDIUM

Key Information:

Vendor

Drupal
Status
Commerce Core
Vendor
CVE Published:
30 October 2026

Badges

👾 Exploit Exists📰 News Worthy

What is CVE-2026-118539?

A vulnerability in Drupal Commerce Core allows attackers to exploit missing authorization mechanisms, leading to potential forceful browsing. This issue affects several versions of Commerce Core, making it crucial for users to update to secure versions to protect their systems from unauthorized access.

Affected Version(s)

Commerce Core 0.0.0 < 2.41

Commerce Core 3.0.0 < 3.3.13

News Articles

favicon imageThe Hacker News

Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

Drupal warns of active exploitation of CVE-2026-118539 in Commerce Core, an authorization bypass flaw that may financially impact vendors.

2 weeks ago

References

https://www.drupal.org/sa-contrib-2026-254

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by The Hacker News

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dan Puccetti (dpuccetti)
Marcus Johansson (marcus_johansson)
Robert Snyder (rsnyd)
Jonathan Sacksick (jsacksick)
Lee Rowlands (larowlan)
Mohit Aghera (mohit_aghera)
Ryan Szrama (rszrama)
Tom Ashe (tomtech)
Jakub Piasecki (zaporylie)
Swan Kalata (akalata)
Bram Driesen (bramdriesen)
Damien McKenna (damienmckenna)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Vijay Mani (vijaycs85)
Jess (xjm)
.