Vulnerabilities · 3h ago
Drupal confirmed active exploitation of an authorization bypass in Commerce Core, affecting versions 0.0.0–2.41 and 3.0.0–3.3.13. The flaw is tracked as CVE-2026-118539; Drupal has not described the attacker activity or how many sites may be affected.
Some Commerce Core routes and entity fields do not adequately check whether a request is allowed. An attacker can therefore bypass access controls to reach commerce functions or fields that should be restricted. Because the module supports sales, checkout, and API-driven commerce, that access could affect vendor transactions or data—not only storefront availability.
Drupal’s silence on campaign scope means a vulnerable version identifies potential exposure, not proof that a particular store was accessed. For sites processing orders or exposing commerce APIs, it remains unknown whether protected routes or fields were reached before the flaw is fixed.
1 source covering this story
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Drupal warns of active exploitation of CVE-2026-118539 in Commerce Core, an authorization bypass flaw that may financially impact vendors.
Part of the PlainSec briefing for 2026-10-30