Critical Authorization Bypass in Drupal Commerce Core (CVE‑2026‑118539) Threatens E‑Commerce Sites
What It Is — Drupal’s Commerce Core module (versions 0.0.0‑2.41 and 3.0.0‑3.3.13) contains a missing‑authorization check that permits forceful browsing of protected routes and entity fields. The flaw (CVE‑2026‑118539) enables an attacker to bypass access controls, potentially read or modify order data, pricing, or customer information without legitimate credentials. Drupal’s own advisory confirms the vulnerability is being actively exploited in the wild, and CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog. The CVSS score is reported as 9.8 Critical.
Affected Products — Drupal Commerce Core module (all releases up to 2.41 and 3.3.13).
Why It Matters for Trust & Control Assurance — The incident highlights the importance of robust access‑control verification and continuous evidence that authorization checks are enforced across all application endpoints. Capability focus: ACCESS_CONTROLS.
Recommended Actions —
- Upgrade immediately to Commerce Core 3.3.13 (or 8.x‑2.41 for earlier branches).
- Conduct a post‑patch review of all custom routes and API endpoints for missing authorization checks.
- Integrate automated access‑control testing into your CI/CD pipeline and capture the results as audit evidence.
Source: SecurityAffairs article