The Drupal Security Team says a highly critical access bypass in the Commerce Core module is being exploited in the wild. The flaw, tracked as CVE-2026-118539, can let an attacker tamper with store data in ways that cost the merchant money, so any Drupal shop running Commerce should update and check its recent orders.
What happened
Drupal published advisory SA-CONTRIB-2026-254 on October 28, 2026, titled “Commerce Core – Highly critical – Access bypass.” It says the module does not sufficiently protect certain routes and entity fields, which leads to an access bypass that may financially impact the vendor. The advisory states plainly that the vulnerability is being actively exploited and tells sites to audit their orders for inconsistencies.
Drupal scored the issue 21 out of 25 on its own risk scale, which is not a CVSS score. A CVSS rating has not been published in the sources we read. The CVE identifier was reported by Security Affairs on October 31, and a security vendor write-up from Rescana on October 30 describes the bug as an order access bypass that can affect both traditional sites and headless setups that use JSON:API. That detail comes from the secondary source and we have not independently confirmed it.
Who is affected
Per the advisory, affected releases are Commerce Core versions below 8.x-2.41 and versions from 3.0.0 up to but not including 3.3.13. Fixes are 3.3.13 for the 3.x line and 8.x-2.41 for earlier releases. Any online shop built on Drupal Commerce that has not applied these updates is in scope. The risk is financial: the advisory describes impact on the vendor, not theft of customer accounts.
| Your version | Update to |
|---|---|
| 3.x (3.0.0 to 3.3.12) | Commerce Core 3.3.13 |
| Earlier than 8.x-2.41 | Commerce Core 8.x-2.41 |
What to do
- Upgrade Commerce Core to the fixed version for your branch as soon as you can. This is from the advisory.
- Audit recent orders, as the advisory instructs. Our analysis: look for unpaid orders marked complete, paid orders with no matching payment record, and unexplained price or discount changes.
- Our analysis: hold fulfillment on suspicious orders until you have confirmed payment with your payment provider.
- Rescana also suggests updating related Commerce modules together and setting JSON:API to read-only where writes are not needed. We have not verified those companion advisories, so check the Drupal project pages for your own modules.
- Our analysis: if you cannot patch today, consider putting the store in maintenance mode rather than leaving it exposed.
What we still do not know
The advisory does not say who is exploiting the flaw, how many stores have been hit, or how long the bug was exploitable before the fix. It lists no workaround. Rescana says two merchants reported fraudulent order attempts and that it saw no evidence of wider automated abuse as of October 29, citing a Drupal Commerce vendor post we did not read, so treat that as unconfirmed. We also have not confirmed whether CISA has added the flaw to its Known Exploited Vulnerabilities catalog.
Sources: Drupal.org, SA-CONTRIB-2026-254 (October 28, 2026); Rescana (October 30, 2026); Security Affairs (October 31, 2026).
Leave a Reply