CVE-2026-118540: Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.

CVE-2026-118540 · Severity: info · Published 2026-10-30

Drupal Commerce is a module that allows e-commerce sites to manage products, shopping carts, and checkout. When used with the JSON:API module, unpublished product variations can be exposed to users who should not have access to them. This could expose product information, pricing, or variants that the site owner intended to keep hidden.

Technologies: Drupal Commerce, Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-118540 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-118540 being exploited in the wild.
How severe is CVE-2026-118540?
Informational severity, published 30 October 2026.
Which products and versions are affected?
Drupal Commerce < 2.41 or >= 3.0.0 and < 3.2.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce ECOSYSTEM:introduced=0,fixed=2.41.0|ECOSYSTEM:introduced=3.0.0,fixed=3.2.0.
Is there a fix for CVE-2026-118540?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 2.41.0 or later. Until then: This vulnerability only affects sites that have both published products and unpublished product variations. Sites without unpublished product variations are not at risk. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118540 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-118540?
Check whether you run Drupal Commerce or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 2.41.0 or later

This vulnerability only affects sites that have both published products and unpublished product variations. Sites without unpublished product variations are not at risk.

Technical details

An information disclosure vulnerability in Drupal Commerce occurs when the JSON:API module is enabled, allowing unauthorized access to unpublished product variations via API queries. The vulnerability requires a site to have both published products and unpublished product variations configured. An attacker with basic network access can retrieve sensitive product data not intended for public view.

Affected products

  • Drupal Commerce < 2.41 or >= 3.0.0 and < 3.2.0

Identifiers

  • CVE-2026-118540
  • DRUPAL-CONTRIB-2026-255

Timeline

  • 2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.