CVE-2026-118539: Missing Authorization in Drupal Commerce Core

Missing Authorization in Commerce Core allows unauthorized browsing. Update to versions 2.41 or 3.3.13.

CVE-2026-118539 is a Missing Authorization vulnerability in Drupal Commerce Core, the ecommerce module of the Drupal platform. It allows forceful browsing against protected resources without explicit authorization. Affected versions include releases from 0.0.0 to 2.41 (legacy branch) and from 3.0.0 to 3.3.13 (current branch).

The CVSS score is not reported in official records. A Missing Authorization in an ecommerce module represents concrete risk to the confidentiality and integrity of customer and order data. The vulnerability was published on October 30, 2026, and is generating online attention: approximately 20 posts on X/Twitter were recorded in the last 24 hours. No confirmed public exploits are reported in verified sources.

Update Drupal Commerce Core immediately to version 2.41 (legacy branch) or 3.3.13 (current branch). After updating, audit access logs to verify whether unauthorized users accessed protected resources. Verify that authorization restrictions are correctly configured. If you cannot update immediately, monitor unusual traffic toward protected resources.

At a glance

What: Missing Authorization in Drupal Commerce Core allows forceful browsing against protected resources without explicit authorization.
Severity: CVSS score not reported. By type, it is a Missing Authorization in an ecommerce module: significant impact on confidentiality and integrity.
Affected versions: Commerce Core from 0.0.0 to 2.41 (legacy branch); Commerce Core from 3.0.0 to 3.3.13 (current branch).
Fix: Update to Commerce Core version 2.41 (legacy) or 3.3.13 (current). Audit access logs after the update.
Status: Published October 30, 2026. No confirmed public exploits in verified sources. Online attention signals: approximately 20 posts in 24 hours.
Action: Update the module as priority, audit logs for unauthorized access to protected resources, monitor unusual traffic.

Sources: NVD, CVE-2026-118539

← All articles