Drupal Commerce Core missing authorization access bypass
A missing authorization flaw in the Drupal Commerce Core module lets unauthenticated attackers bypass access controls on certain routes and entity fields. Drupal confirms exploitation.
- Vendor
- Drupal
- Product
- Commerce Core (contributed module)
- CVSS
- N/A
- EPSS (exploit probability)
- 0.2%
- Status
- exploited-in-wild
- Published
Is CVE-2026-118539 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2026-118539 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-30 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.2% (scored October 30, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-30. Full cross-catalog view: /kev-comparison
CVE-2026-118539 timeline
- Exploitation reported-2d (before NVD)Drupal advisory states active exploitation
- Patch available-2d (before NVD)Fixed in Commerce Core 3.3.13 and 8.x-2.41
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Drupal’s security team rates this “highly critical” (21 out of 25 on its risk scale). The module does not sufficiently protect certain routes and entity fields, which allows an access bypass that may financially impact the store owner. Unauthenticated attackers can exploit it regardless of module configuration, per SecurityWeek.
Affected versions: reported as Commerce Core 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Confirm against Drupal’s advisory.
Fixed versions: Commerce Core 3.3.13 (3.x branch) and 8.x-2.41 (earlier releases).
What to do: update, then audit orders for inconsistencies, as the advisory directs. Drupal has not disclosed how the flaw is exploited, by whom, or at what scale. No numeric CVSS score was published in the sources we reviewed.
Read our full coverage: Drupal Commerce Core Bypass Exploited, Patch 3.3.13.
Other Drupal CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-9082 Drupal Core SQL Injection Vulnerability | [ CRITICAL ] | 9.8 | 89.4% | |
| CVE-2018-7602 Drupal Core Remote Code Execution Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 99.2% | |
| CVE-2019-6340 Drupal Core Remote Code Execution Vulnerability | [ HIGH ] | 8.1 | 92.0% | |
| CVE-2020-13671 Drupal core Un-restricted Upload of File | [ HIGH ] | 8.8 | 36.2% | |
| CVE-2018-7600 Drupal Core Remote Code Execution Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 100.0% |
