Critical Authorization Bypass (CVE‑2026‑118539) in Drupal Commerce Core Actively Exploited
What It Is — Drupal’s Commerce Core module (versions 0.0.0‑2.41 and 3.0.0‑3.3.13) contains a missing‑authorization flaw (CVE‑2026‑118539). The defect allows an unauthenticated attacker to invoke commerce‑related actions—such as creating, modifying, or deleting orders—without the system verifying the requester’s privileges. Threat actors are already leveraging the issue in the wild, targeting e‑commerce sites that run the vulnerable module. Drupal has issued an advisory and recommends upgrading to version 2.41 or 3.3.14, which include the fix. No CVSS score has been published, but the vendor describes the vulnerability as “highly critical.”
Affected Products — Drupal Commerce Core (all releases up to 2.41 and 3.3.13).
Why It Matters for Trust & Control Assurance — The flaw directly tests the control objective of enforcing proper access authorization and least‑privilege enforcement. Demonstrating that such controls are continuously monitored and evidentially enforced is a core trust signal.
Recommended Actions —
- Upgrade immediately to Drupal Commerce 2.41 or 3.3.14 (or later).
- Review any custom extensions for similar authorization gaps.
- Enable detailed logging of commerce‑related API calls and audit them for anomalous activity.
- Incorporate the patch status into your continuous compliance monitoring dashboard.
Source: The Hacker News