{"id":"CVE-2026-118541","aliases":["DRUPAL-CONTRIB-2026-256","EUVD-2026-113516","GHSA-p6j3-r2g3-f8vm"],"status":"published","title":"Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256","description":"Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00193,"percentile":0.09118,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-10-28T16:55:39Z","modified":"2026-11-06T13:07:03Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce","fixed_in":["2.41.0","3.3.13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.0"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.13"}]}]}],"products":[{"vendor":"drupal","product":"commerce core"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-256","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118541","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p6j3-r2g3-f8vm"},{"url":"https://git.drupalcode.org/project/commerce","tags":["web"]},{"url":"https://www.drupal.org/project/commerce","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118541.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-118541","title":"Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256","description":"Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T03:09:11.899Z","modified":"2026-11-06T13:07:03.365Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T14:58:28.173309Z"}],"euvd":[{"id":"EUVD-2026-113516","description":"Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T03:09:11Z","modified":"2026-11-06T13:07:03Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T14:05:02.958369Z"}],"ghsa":[{"id":"GHSA-p6j3-r2g3-f8vm","title":"Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This...","description":"Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T06:31:57Z","modified":"2026-11-06T15:32:21Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T16:00:41.773289Z"}],"nvd":[{"id":"CVE-2026-118541","description":"Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T04:18:19.1Z","modified":"2026-11-06T13:17:25.68Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T16:00:35.469074Z"}],"osv":[{"id":"CVE-2026-118541","title":"Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256","description":"Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T03:09:11.899Z","modified":"2026-11-08T02:31:06.898532685Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-07T03:08:01.41647Z"},{"id":"DRUPAL-CONTRIB-2026-256","description":"This module enables you to sell goods and services to customers through a shopping cart and checkout form. It includes a feature to manage promotions and the coupons that apply them.\n\nThe module doesn't sufficiently check access to the relationship between promotions and coupons. A user who is only allowed to manage their own promotions can delete or change coupons that belong to other promotions.\n\nThis vulnerability is mitigated by the fact that the site must accept writes through JSON:API or REST, which is not enabled by default.","status":"published","published":"2026-10-28T16:55:39Z","modified":"2026-10-28T18:15:03.627478817Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}