CVE-2026-118539 is a highly critical access bypass vulnerability in Commerce Core, a shopping cart and checkout component used on Drupal sites. The flaw occurs because the module does not sufficiently protect certain routes and entity fields, allowing unauthorized access to functionality or data that should be restricted. The affected versions are Commerce Core versions before 8.x-2.41 and Commerce Core 3.x versions before 3.3.13. The vulnerability can be exploited without authentication and without additional access complexity, and it affects all site configurations, meaning an unauthenticated attacker can potentially reach protected routes or manipulate entity fields. Because Commerce Core handles order and checkout processes, successful exploitation can lead to direct financial losses for store owners, including unexpected prices, altered totals, or inconsistent order status changes. The risk assessment rates confidentiality and integrity impact as some, indicating that unauthorized access may expose or modify sensitive commercial data. The broad applicability across configurations and the absence of authentication requirements make the issue especially significant for e-commerce deployments, where compromised order integrity can undermine customer trust and revenue.
We recommend you to update Commerce Core to version 3.3.13 or 8.x-2.41 depending on your installed branch.[/subscribe_to_unlock_form]
CVE-2026-118539 is a highly critical access bypass vulnerability in Commerce Core, a shopping cart and checkout component used on Drupal sites. The flaw occurs because the module does not sufficiently protect certain routes and entity fields, allowing unauthorized access to functionality or data that should be restricted. The affected versions are Commerce Core versions before 8.x-2.41 and Commerce Core 3.x versions before 3.3.13. The vulnerability can be exploited without authentication and without additional access complexity, and it affects all site configurations, meaning an unauthenticated attacker can potentially reach protected routes or manipulate entity fields. Because Commerce Core handles order and checkout processes, successful exploitation can lead to direct financial losses for store owners, including unexpected prices, altered totals, or inconsistent order status changes. The risk assessment rates confidentiality and integrity impact as some, indicating that unauthorized access may expose or modify sensitive commercial data. The broad applicability across configurations and the absence of authentication requirements make the issue especially significant for e-commerce deployments, where compromised order integrity can undermine customer trust and revenue.
We recommend you to update Commerce Core to version 3.3.13 or 8.x-2.41 depending on your installed branch.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]