Zero Radar
← feed
CriticalVulnerabilityCVE-2026-118539updated 30 Oct 2026, 19:32 UTC

Drupal Commerce Core lets attackers bypass access checks on online stores

Attackers can reach store pages and data they should not be able to see or change, such as orders. Attacks are already happening against online shops.

Attacks reported (The Hacker News, BleepingComputer)Fix available · out Official, 6 sources
SeverityCriticalCVSS 6.5 of 10
Being exploited?ReportedBy The Hacker News, BleepingComputer, SecurityWeek, not officially confirmed yet
Fix available?Yesdrupal/commerce 2.41.0 (2.x branch); drupal/commerce 3.3.13 (3.x branch) · since 30 Oct 2026
How sure is this?Official, 6 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerScans for Drupal Commerce stores
  2. 2Direct requestRequests restricted store pages directly
  3. 3Missing checkCommerce Core skips authorization
  4. 4Store dataOrders and records are exposed
  5. ResultAttacker reads or alters store data

What happened

Drupal Commerce Core (drupal/commerce) has a missing authorization flaw that allows forceful browsing, meaning users can access restricted resources directly without proper permission checks.

Why it is dangerous: Attackers can view or manipulate orders and other store data on affected shops, and store owners and their customers are at risk.

Are you affected?

You are affected if your Drupal site runs Commerce Core 2.40 or earlier (from 0.0.0 to 2.41 exclusive of 2.41.0), or 3.0.0 through 3.3.12.

Package / productAffected versionsFixed in
drupal/commerce · composer< 2.41.02.41.0
drupal/commerce · composer>= 3.0.0, < 3.3.133.3.13

What to do

  1. Update drupal/commerce to 2.41.0 or later if you use the 2.x branch, or to 3.3.13 or later if you use the 3.x branch
  2. Audit recent orders and store records for unexpected access or changes
  3. Review your web server and Drupal logs for requests to restricted Commerce pages from unknown users

Timeline

  1. 30 Oct 2026, 04:18 UTC
    Publicly disclosed
  2. 30 Oct 2026, 07:45 UTC
    Reported by The Hacker News · The Hacker News
  3. 30 Oct 2026, 08:50 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 08:52 UTC
    OSV reported on it · OSV
  5. 30 Oct 2026, 08:52 UTC
    Fixed version published: drupal/commerce 2.41.0, drupal/commerce 3.3.13 · OSV
  6. 30 Oct 2026, 08:52 UTC
    Fix: drupal/commerce 2.41.0 (for the 2.x line); drupal/commerce 3.3.13 (for the 3.x line)
  7. 30 Oct 2026, 10:16 UTC
    BleepingComputer reported on it · BleepingComputer
  8. 30 Oct 2026, 10:50 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)
  9. 30 Oct 2026, 11:12 UTC
    SecurityWeek reported on it · SecurityWeek
  10. 30 Oct 2026, 19:32 UTC
    NVD reported on it · NVD

Sources 6 reports, oldest first

Official vendor, government CERT or advisory database

Security press established security newsrooms

Technical details

ID
CVE-2026-118539
CVSS
6.5 / 10
Disclosed
30 Oct 2026, 04:18 UTC
On Zero Radar
30 Oct 2026, 08:50 UTC (5 h after disclosure)
Last change
30 Oct 2026, 19:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Drupal Commerce Core lets attackers bypass access checks on online stores · Zero Radar