CVE-2026-118539: Drupal Commerce access bypass in entity and route protection

CVE-2026-118539 · Severity: info · Published 2026-10-30

Drupal Commerce is a module that enables online sales through shopping carts and checkout systems. The module fails to properly protect certain API routes and data fields, allowing unauthorized access that could lead to financial damage to vendors. This vulnerability is actively being exploited.

Technologies: Drupal Commerce, Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-118539 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-118539 being exploited in the wild.
How severe is CVE-2026-118539?
Informational severity, published 30 October 2026.
Which products and versions are affected?
Drupal Commerce all versions prior to 2.41; versions 3.0.0 through 3.3.12; Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce ECOSYSTEM:introduced=0,fixed=2.41.0|ECOSYSTEM:introduced=3.0.0,fixed=3.3.13.
Is there a fix for CVE-2026-118539?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 2.41.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118539 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-118539?
Check whether you run Drupal Commerce or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 2.41.0 or later

Technical details

The vulnerability is an access control bypass affecting Drupal Commerce routes and entity fields due to insufficient permission checks. An attacker with network access can bypass authorization controls to access or manipulate protected resources via API calls or direct route access, potentially exposing transaction data or enabling fraudulent operations. A fix is available in patched versions.

Affected products

  • Drupal Commerce all versions prior to 2.41; versions 3.0.0 through 3.3.12

Identifiers

  • CVE-2026-118539
  • DRUPAL-CONTRIB-2026-254

Timeline

  • 2026-10-28: disclosed
  • 2026-10-28: exploited: actively exploited in the wild

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.