{"id":"CVE-2026-118543","aliases":["DRUPAL-CONTRIB-2026-258","EUVD-2026-113514","GHSA-h38c-8g33-pr7c"],"status":"published","title":"Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00158,"percentile":0.04977,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2026-10-28T16:55:58Z","modified":"2026-11-06T13:03:33Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce","fixed_in":["2.41.0","3.3.13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.0"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.13"}]}]}],"products":[{"vendor":"drupal","product":"commerce core"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-258","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118543","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h38c-8g33-pr7c"},{"url":"https://git.drupalcode.org/project/commerce","tags":["web"]},{"url":"https://www.drupal.org/project/commerce","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118543.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-118543","title":"Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T03:09:09.8Z","modified":"2026-11-06T13:03:33.194Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-06T14:58:28.173309Z"}],"euvd":[{"id":"EUVD-2026-113514","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T03:09:09Z","modified":"2026-11-06T13:03:33Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T14:05:02.958369Z"}],"ghsa":[{"id":"GHSA-h38c-8g33-pr7c","title":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request...","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T06:31:57Z","modified":"2026-11-06T15:31:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-06T16:00:39.918673Z"}],"nvd":[{"id":"CVE-2026-118543","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T04:18:19.39Z","modified":"2026-11-06T13:17:26.017Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-06T16:00:35.469074Z"}],"osv":[{"id":"CVE-2026-118543","title":"Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.","status":"published","published":"2026-10-30T03:09:09.8Z","modified":"2026-11-08T02:31:05.309911576Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-07T03:08:01.41647Z"},{"id":"DRUPAL-CONTRIB-2026-258","description":"This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates.\n\nRoutes for the inbox do not check for a CSRF token. As a result, an attacker can trick a user with the \"access commerce administration pages\" permission into visiting a crafted page that will dismiss notifications for the messages. The inbox is also shared by all users, so if one commerce administrator is tricked, this hides the messages from every administrator, including notices that a security update is available.","status":"published","published":"2026-10-28T16:55:58Z","modified":"2026-10-28T18:15:05.528969963Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}