{"id":"CVE-2026-118539","aliases":["DRUPAL-CONTRIB-2026-254","EUVD-2026-113518","GHSA-372m-625x-8m53"],"status":"published","title":"Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254","description":"Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00671,"percentile":0.5253,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-10-28T16:54:55Z","modified":"2026-11-05T21:32:21Z","exploits":[{"source":"nuclei","id":"CVE-2026-118539","title":"Drupal Commerce Core \u003c 3.3.13 / \u003c 8.x-2.41 - Guest Cart Admin Access Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-118539.yaml"}],"fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce","fixed_in":["2.41.0","3.3.13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.0"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.13"}]}]}],"products":[{"vendor":"drupal","product":"commerce core"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-254","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118539","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-372m-625x-8m53"},{"url":"https://git.drupalcode.org/project/commerce","tags":["web"]},{"url":"https://www.drupal.org/project/commerce","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118539.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-118539","title":"Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254","description":"Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T03:09:13.976Z","modified":"2026-10-31T03:56:19.259Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:04.156238Z"}],"euvd":[{"id":"EUVD-2026-113518","description":"Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T03:09:13Z","modified":"2026-10-31T03:56:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:01.198534Z"}],"ghsa":[{"id":"GHSA-372m-625x-8m53","title":"Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue...","description":"Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T06:31:57Z","modified":"2026-10-30T21:32:10Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:14:52.597654Z"}],"nvd":[{"id":"CVE-2026-118539","description":"Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T04:18:18.83Z","modified":"2026-10-31T04:18:17.15Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:13:04.940026Z"}],"osv":[{"id":"CVE-2026-118539","title":"Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254","description":"Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T03:09:13.976Z","modified":"2026-11-05T21:32:21.016176396Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-05T22:00:34.245765Z"},{"id":"DRUPAL-CONTRIB-2026-254","description":"This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs.\n\nThe module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor.\n\nThis vulnerability is being actively exploited in the wild.","status":"published","published":"2026-10-28T16:54:55Z","modified":"2026-10-28T20:08:42Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}