Cross-Site Request Forgery Vulnerability in Drupal Commerce Stripe
CVE-2026-118558

7.3HIGH

Key Information:

Vendor

Drupal
Status
Commerce Stripe
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118558?

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Drupal Commerce Stripe module, allowing unauthorized actions to be performed on behalf of authenticated users. This exploit could potentially lead to sensitive information compromise or illegitimate financial transactions. Affected versions range from 2.0.0 to 2.2.3. It is recommended to update to the latest version to mitigate these risks and safeguard your web application.

Affected Version(s)

Commerce Stripe 2.0.0 < 2.2.3

References

https://www.drupal.org/sa-contrib-2026-263

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Willows (hsjbrianwillows)
Ryan Szrama (rszrama)
Tom Ashe (tomtech)
Jonathan Sacksick (jsacksick)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.