Critical Authorization Flaw Exploited in Drupal Commerce Core
Active exploitation of CVE-2026-118539 threatens online stores using vulnerable Drupal Commerce modules.
1Critical Authorization Vulnerability Identified
Drupal has issued an urgent warning regarding a critical security flaw, tracked as CVE-2026-118539, within its Commerce Core module. The vulnerability stems from missing authorization checks, which allow unauthorized access to sensitive routes and entity fields. This flaw directly impacts the security of online stores utilizing the module for transactions.
2Scope of Affected Versions
The security advisory confirms that the vulnerability affects a wide range of Commerce Core versions. Specifically, installations running versions from 0.0.0 to 2.41, as well as those in the 3.0.0 to 3.3.13 range, are currently at risk. Administrators must verify their specific version numbers to determine if their store requires an immediate patch.
3Mechanism of Active Exploitation
Threat actors are actively exploiting this flaw in the wild to perform forceful browsing. By bypassing insufficient protection on specific routes and entity fields, attackers can potentially access checkout forms or API-driven data. This unauthorized access poses a significant financial risk to vendors who rely on the module for processing customer sales.
4Discovery and Reporting Details
The vulnerability was identified and reported to the Drupal maintainers by security researchers Dan Puccetti, Marcus Johansson, and Robert Snyder. Their findings highlighted the critical nature of the access bypass, prompting the project to confirm active exploitation. The collaborative disclosure process ensures that maintainers can provide necessary updates to the community.
5Required Remediation Steps
Drupal strongly recommends that all users update their Commerce Core installations to the latest available releases immediately. Users operating on the 3.x branch are advised to upgrade to version 3.3.13. Meanwhile, those maintaining earlier releases must move to version 8.x-2.41 to effectively mitigate the risk of unauthorized access and potential exploitation.
6Context of Recent Threats
This incident follows a previous warning issued in May regarding a separate SQL injection flaw, tracked as CVE-2026-9082. That vulnerability, located in the database abstraction API, allowed attackers to gain elevated privileges and execute remote code. The US Cybersecurity and Infrastructure Security Agency subsequently added that specific flaw to its KEV catalog.
7Operational Impact on Vendors
Because the Commerce Core module facilitates shopping carts and checkout forms, any compromise directly threatens the integrity of financial transactions. The ability for attackers to interact with decoupled applications via APIs increases the attack surface significantly. Vendors must prioritize these security updates to prevent data breaches and maintain customer trust during operations.
8Security Posture and Maintenance
The active exploitation of CVE-2026-118539 underscores the necessity of maintaining updated dependencies in e-commerce environments. As threat actors continue to target authorization flaws, regular patching cycles remain the primary defense for Drupal-based platforms. Organizations should monitor security advisories closely to ensure that their infrastructure remains resilient against evolving exploitation techniques in production.
Original article: Security Affairs — Critical Authorization Flaw Exploited in Drupal Commerce Core