{"id":"CVE-2026-118557","aliases":["DRUPAL-CONTRIB-2026-262","EUVD-2026-113510","GHSA-rx8q-gw9q-37vf"],"status":"published","title":"Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262","description":"Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00187,"percentile":0.08384,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-10-28T16:56:34Z","modified":"2026-11-06T13:48:21Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce_shipping","fixed_in":["2.16.0","3.0.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/commerce_shipping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.0"}]},{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.6"}]}]}],"products":[{"vendor":"drupal","product":"commerce shipping"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-262","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118557","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rx8q-gw9q-37vf"},{"url":"https://git.drupalcode.org/project/commerce_shipping","tags":["web"]},{"url":"https://www.drupal.org/project/commerce_shipping","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118557.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-118557","title":"Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262","description":"Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.","status":"published","published":"2026-10-30T03:09:04.516Z","modified":"2026-11-06T13:48:21.848Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T14:58:28.173309Z"}],"euvd":[{"id":"EUVD-2026-113510","description":"Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.","status":"published","published":"2026-10-30T03:09:04Z","modified":"2026-11-06T13:48:21Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-06T15:05:10.688381Z"}],"ghsa":[{"id":"GHSA-rx8q-gw9q-37vf","title":"Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This...","description":"Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.","status":"published","published":"2026-10-30T06:31:58Z","modified":"2026-11-06T15:32:22Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T16:00:41.773289Z"}],"nvd":[{"id":"CVE-2026-118557","description":"Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.","status":"published","published":"2026-10-30T04:18:21.27Z","modified":"2026-11-06T14:17:07.63Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T16:00:35.469074Z"}],"osv":[{"id":"CVE-2026-118557","title":"Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262","description":"Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.","status":"published","published":"2026-10-30T03:09:04.516Z","modified":"2026-11-08T02:30:41.812051403Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-07T03:08:01.41647Z"},{"id":"DRUPAL-CONTRIB-2026-262","description":"This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment.\n\nThe module doesn't sufficiently check access on the form to resend receipts. Under certain configurations, this allows some users to gain access to receipts and customer information for orders they should not be able to access.","status":"published","published":"2026-10-28T16:56:34Z","modified":"2026-10-28T18:15:04.726922409Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}