Incorrect Authorization Vulnerability in Drupal Commerce Core
CVE-2026-118542

2.7LOW

Key Information:

Vendor

Drupal
Status
Commerce Core
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118542?

A vulnerability in Drupal Commerce Core enables an attacker to perform unauthorized actions through forceful browsing. This issue could allow users to access restricted resources without proper authorization, compromising the security and integrity of the application. Affected versions include Commerce Core from 0.0.0 up to 2.41.0 and from 3.0.0 to 3.3.13, underscoring the importance of applying security patches to thwart potential exploits.

Affected Version(s)

Commerce Core 0.0.0 < 2.41.0

Commerce Core 3.0.0 < 3.3.13

References

https://www.drupal.org/sa-contrib-2026-257

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Jonathan Sacksick (jsacksick)
Tom Ashe (tomtech)
Jakub Piasecki (zaporylie)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Jess (xjm)
.