Skip to content
Hacker Posts

Drupal Commerce Core access-bypass flaw exploited (CVE-2026-118539)

Drupal says CVE-2026-118539, a highly critical access bypass in Commerce Core, is exploited in the wild. Fixes are in 3.3.13 and 8.x-2.41. Audit orders for tampering.

Published 2 min read
cvedrupaladvisoryecommerce

Drupal warns that CVE-2026-118539, a "highly critical" access-bypass flaw in the Commerce Core contributed module, is being exploited in the wild. The advisory is SA-contrib-2026-254. If you run a Drupal Commerce storefront, patch today and audit your orders.

What the flaw does

Commerce Core "doesn't sufficiently protect certain routes and entity fields," which an unauthenticated attacker can abuse to bypass access controls (CWE: missing authorization). Drupal's advisory is tagged highly critical; it does not publish a numeric CVSS score. It is an authorization bug, not SQL injection — the risk is direct manipulation of commerce data and routes that should be protected. The advisory credits Dan Puccetti, Marcus Johansson and Robert Snyder.

Affected versions

  • Commerce Core 0.0.0 through 2.41
  • Commerce Core 3.0.0 through 3.3.13

Fixed versions

  • 3.x branch: upgrade to Commerce Core 3.3.13
  • Earlier releases: upgrade to Commerce Core 8.x-2.41

Apply the fix per the upgrade path in SA-contrib-2026-254.

Exploitation status

Drupal states the flaw is actively exploited but has not published details, extent, or indicators of compromise, per reporting at BleepingComputer and The Hacker News. In the absence of upstream IOCs, Drupal's own guidance is to audit orders for inconsistencies — unexpected status changes, price or total mismatches, or orders that skipped a payment step.

Action checklist

  1. Upgrade Commerce Core to 3.3.13 (3.x) or 8.x-2.41 (earlier) now. This is a contributed-module update, separate from Drupal core.
  2. Audit recent orders for tampering: status transitions that bypassed payment, altered totals, and entity fields modified outside normal checkout.
  3. Review web and application logs for unauthenticated requests to Commerce routes and entity endpoints.
  4. If you find evidence of abuse, treat affected orders and any exposed customer/payment data as compromised and follow your incident process.

Context

This is the second critical Drupal RCE/authorization story on our radar this month, after the Field UI RCE in core (CVE-2026-108097) and, earlier, the PostgreSQL SQLi in core (CVE-2026-9082). The recurring lesson for Drupal operators: contributed modules carry the same blast radius as core, and a commerce module that gates money and customer records is exactly where a missing-authorization bug turns into real losses.

Related stories