# CVE-2026-118539: Drupal Commerce access bypass in entity and route protection

Source: https://junglewise.ai/threats/cve-2026-118539-drupal-contrib-2026-254-this-module-enables-you-to-sell-goods  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-118539 · Severity: info · Published 2026-10-30

Drupal Commerce is a module that enables online sales through shopping carts and checkout systems. The module fails to properly protect certain API routes and data fields, allowing unauthorized access that could lead to financial damage to vendors. This vulnerability is actively being exploited.

Technologies: [Drupal Commerce](https://junglewise.ai/threats/technologies/drupal-commerce-1), [Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce](https://junglewise.ai/threats/technologies/drupal-commerce). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-118539 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118539 being exploited in the wild.

**How severe is CVE-2026-118539?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Drupal Commerce all versions prior to 2.41; versions 3.0.0 through 3.3.12; Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce ECOSYSTEM:introduced=0,fixed=2.41.0|ECOSYSTEM:introduced=3.0.0,fixed=3.3.13.

**Is there a fix for CVE-2026-118539?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 2.41.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118539 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118539?** Check whether you run Drupal Commerce or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 2.41.0 or later

## Technical details

The vulnerability is an access control bypass affecting Drupal Commerce routes and entity fields due to insufficient permission checks. An attacker with network access can bypass authorization controls to access or manipulate protected resources via API calls or direct route access, potentially exposing transaction data or enabling fraudulent operations. A fix is available in patched versions.

## Affected products

- Drupal Commerce all versions prior to 2.41; versions 3.0.0 through 3.3.12

## Identifiers

- CVE-2026-118539
- DRUPAL-CONTRIB-2026-254

## Timeline

- 2026-10-28: disclosed
- 2026-10-28: exploited: actively exploited in the wild

## References

- [https://www.drupal.org/u/dpuccetti](https://www.drupal.org/u/dpuccetti)
- [https://www.drupal.org/u/marcus_johansson](https://www.drupal.org/u/marcus_johansson)

## Related threats

- [Drupal Commerce Core information disclosure via JSON:API product variations](https://junglewise.ai/threats/cve-2026-118544-drupal-contrib-2026-259-this-module-enables-you-to-sell-goods)
- [Drupal Commerce CSRF vulnerability in inbox routes](https://junglewise.ai/threats/cve-2026-118543-drupal-contrib-2026-258-this-module-enables-you-to-sell-goods)
- [Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.](https://junglewise.ai/threats/cve-2026-118542-drupal-contrib-2026-257-this-module-enables-you-to-sell-goods)
- [Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.](https://junglewise.ai/threats/cve-2026-118541-drupal-contrib-2026-256-this-module-enables-you-to-sell-goods)
- [Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.](https://junglewise.ai/threats/cve-2026-118540-drupal-contrib-2026-255-this-module-enables-you-to-sell-goods)