CVE-2026-122071
CVE-2026-122071 is a vulnerability with no CVSS score yet in drupal/commerce_escrow, published November 4, 2026. No source lists public exploit code. Fixed in drupal/commerce_escrow 1.1.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.1.0drupal/commerce_escrow
Description
This module enables you to accept payments through Escrow.com with Drupal Commerce.
The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are in progress.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/commerce_escrowPackagist:https://packages.drupal.org/8 | before 1.1.0 | 1.1.0 |
What each source reports
OSVDRUPAL-CONTRIB-2026-302No score
This module enables you to accept payments through Escrow.com with Drupal Commerce.
The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are in progress.
- Record
DRUPAL-CONTRIB-2026-302- Updated
- 2026-11-04
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.