Vulnerability
CVE-2026-118539
Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
CVSS score (v3.1)6.5Medium
Not on CISA KEV list
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- Published by NVD
- Last updated by NVD
- First covered by RedTeamDaily
Coverage
Drupal Commerce Core access bypass flaw CVE-2026-118539 under active exploitation
Drupal reports active exploitation of CVE-2026-118539, a missing authorization flaw in the Commerce Core module, rated highly critical (21 out of 25 on Drupal's own scale, not CVSS). It affects versions before 2.41 and 3.0.0 up to but not including 3.3.13, and needs no authentication. Administrators should update to 2.41 or 3.3.13 and audit orders against expected prices and payment records.
Sources: NVD and CISA known exploited vulnerabilities catalogue.