{"id":"CVE-2025-48446","aliases":["DRUPAL-CONTRIB-2025-067","EUVD-2025-18126","GHSA-48wx-8736-jgx2"],"status":"published","title":"Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067","description":"Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00343,"percentile":0.28222,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2025-05-21T17:28:55Z","modified":"2026-10-28T02:31:07Z","fixes":[{"ecosystem":"Packagist","package":"drupal/commerce_alphabank_redirect","fixed_in":["1.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce_alphabank_redirect","fixed_in":["1.0.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/commerce_alphabank_redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce_alphabank_redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/commerce_alphabank_redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]}],"products":[{"vendor":"commerce_alphabank_redirect_project","product":"commerce_alphabank_redirect"},{"vendor":"drupal","product":"commerce alphabank redirect"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-067","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48446","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-48wx-8736-jgx2"},{"url":"https://git.drupalcode.org/project/commerce_alphabank_redirect","tags":["web"]},{"url":"https://www.drupal.org/project/commerce_alphabank_redirect","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48446.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-48446","title":"Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067","description":"Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.","status":"published","published":"2025-06-11T14:34:50.071Z","modified":"2025-06-11T15:48:21.281Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:32:41.41198Z"}],"euvd":[{"id":"EUVD-2025-18126","description":"Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.","status":"published","published":"2025-06-11T14:34:50Z","modified":"2025-06-11T15:48:21Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:24.98161Z"}],"ghsa":[{"id":"GHSA-48wx-8736-jgx2","title":"Drupal Commerce Alphabank Redirect Incorrect Authorization vulnerability","description":"Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse. This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.","status":"published","published":"2025-06-11T15:30:29Z","modified":"2025-06-11T18:02:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:38:46.901955Z"}],"nvd":[{"id":"CVE-2025-48446","description":"Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.","status":"published","published":"2025-06-11T15:15:42.427Z","modified":"2026-06-17T09:29:38.87Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:11:11.789448Z"}],"osv":[{"id":"CVE-2025-48446","title":"Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067","description":"Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.","status":"published","published":"2025-06-11T14:34:50.071Z","modified":"2026-10-28T02:31:07.84350478Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"GHSA-48wx-8736-jgx2","title":"Drupal Commerce Alphabank Redirect Incorrect Authorization vulnerability","description":"Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse. This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.","status":"published","published":"2025-06-11T15:30:29Z","modified":"2025-12-10T23:40:58.626106Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"DRUPAL-CONTRIB-2025-067","description":"This module enables you to pay for Commerce order to an environment provided and secured by the bank\n\nThe module doesn't sufficiently verify the payment status on canceled orders. An attacker can issue a specially crafted request to update the order status to completed.","status":"published","published":"2025-05-21T17:28:55Z","modified":"2026-09-10T03:45:17.805169974Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}