{"id":"CVE-2025-48445","aliases":["DRUPAL-CONTRIB-2025-066","EUVD-2025-18125","GHSA-q9h3-r6wr-p3j3"],"status":"published","title":"Commerce Eurobank (Redirect) - Moderately critical - Access bypass - SA-CONTRIB-2025-066","description":"Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00331,"percentile":0.26643,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2025-05-21T17:28:47Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"Packagist","package":"drupal/commerce_eurobank_redirect","fixed_in":["2.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce_eurobank_redirect","fixed_in":["2.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/commerce_eurobank_redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1"}]}]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce_eurobank_redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/commerce_eurobank_redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1"}]}]}],"products":[{"vendor":"commerce_eurobank_\\(redirect\\)_project","product":"commerce_eurobank_\\(redirect\\)"},{"vendor":"drupal","product":"commerce eurobank (redirect)"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-066","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48445","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q9h3-r6wr-p3j3"},{"url":"https://git.drupalcode.org/project/commerce_eurobank_redirect","tags":["web"]},{"url":"https://www.drupal.org/project/commerce_eurobank_redirect","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48445.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-48445","title":"Commerce Eurobank (Redirect) - Moderately critical - Access bypass - SA-CONTRIB-2025-066","description":"Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.","status":"published","published":"2025-06-11T14:31:03.526Z","modified":"2025-06-11T15:38:27.544Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:32:41.41198Z"}],"euvd":[{"id":"EUVD-2025-18125","description":"Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.","status":"published","published":"2025-06-11T14:31:03Z","modified":"2025-06-11T15:38:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:24.98161Z"}],"ghsa":[{"id":"GHSA-q9h3-r6wr-p3j3","title":"Drupal Commerce Eurobank (Redirect) Incorrect Authorization vulnerability","description":"Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse. This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.","status":"published","published":"2025-06-11T15:30:29Z","modified":"2025-06-11T17:50:15Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:38:46.901955Z"}],"nvd":[{"id":"CVE-2025-48445","description":"Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.","status":"published","published":"2025-06-11T15:15:42.27Z","modified":"2026-06-17T09:29:38.73Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:11:11.789448Z"}],"osv":[{"id":"CVE-2025-48445","title":"Commerce Eurobank (Redirect) - Moderately critical - Access bypass - SA-CONTRIB-2025-066","description":"Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.","status":"published","published":"2025-06-11T14:31:03.526Z","modified":"2026-10-28T02:31:08.871575479Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"GHSA-q9h3-r6wr-p3j3","title":"Drupal Commerce Eurobank (Redirect) Incorrect Authorization vulnerability","description":"Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse. This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.","status":"published","published":"2025-06-11T15:30:29Z","modified":"2025-12-10T23:41:21.194975Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"DRUPAL-CONTRIB-2025-066","description":"This module enables you to pay for Commerce order to an environment provided and secured by the bank\n\nThe module doesn't sufficiently verify the payment status on canceled orders. An attacker can issue a specially crafted request to update the order status to completed.","status":"published","published":"2025-05-21T17:28:47Z","modified":"2026-09-10T03:45:17.77123583Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}