CVE-2026-118544
Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
- Record
CVE-2026-118544- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-202
- Updated
- 2026-11-06
EUVDEUVD-2026-113513
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
- Record
EUVD-2026-113513- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-v5mv-g539-3hqf
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core...
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
- Record
GHSA-v5mv-g539-3hqf- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-202
- Updated
- 2026-11-06
NVD
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
- Record
CVE-2026-118544- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-202
- Updated
- 2026-11-06
OSV
Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
- Record
CVE-2026-118544- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-202
- Updated
- 2026-11-07
OSVDRUPAL-CONTRIB-2026-259 No score
This module enables you to sell goods and services to customers through a shopping cart and checkout form.
The module doesn't sufficiently restrict the product variations returned by entity queries to the variations the current user can view. When the core JSON:API module is enabled, a visitor can make repeated requests that eventually determine certain field values on an unpublished product variation, or a variation of an unpublished product.
This vulnerability is mitigated by the fact that the core JSON:API module must be enabled.
- Record
DRUPAL-CONTRIB-2026-259- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/commercePackagist:https://packages.drupal.org/8 |
before 2.41.0, 3.0.0 up to 3.3.13 | 2.41.03.3.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| severity | CVE List, EUVD | |
| facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-118544 is a low vulnerability (CVSS 3.7) in Drupal Commerce Core, published October 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in drupal/commerce 2.41.0.