CVE-2026-118541: Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.

CVE-2026-118541 · Severity: info · Published 2026-10-30

Drupal Commerce is an e-commerce module that manages shopping carts, checkout, promotions, and coupons. A user with permission to manage only their own promotions can bypass access controls to delete or modify coupons belonging to other promotions. The vulnerability requires JSON:API or REST to be enabled for exploitation, which is not the default configuration.

Technologies: Drupal Commerce Core, Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-118541 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-118541 being exploited in the wild.
How severe is CVE-2026-118541?
Informational severity, published 30 October 2026.
Which products and versions are affected?
Drupal Commerce Core <2.41.0; >=3.0.0 <3.3.13; Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce ECOSYSTEM:introduced=0,fixed=2.41.0|ECOSYSTEM:introduced=3.0.0,fixed=3.3.13.
Is there a fix for CVE-2026-118541?
Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 2.41.0 or later. Until then: Ensure JSON:API and REST APIs are not enabled unless required for your site's functionality. If these APIs must be active, restrict write access to trusted roles only.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-28"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118541 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-118541?
Check whether you run Drupal Commerce Core or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 2.41.0 or later

Ensure JSON:API and REST APIs are not enabled unless required for your site's functionality. If these APIs must be active, restrict write access to trusted roles only.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-28"}]

Technical details

An insufficient access control check in the promotion-coupon relationship allows privilege escalation. A user with limited promotion management permissions can manipulate coupons outside their scope via JSON:API or REST endpoints. The flaw is mitigated by default since these APIs are disabled by default in Drupal installations.

Affected products

  • Drupal Commerce Core <2.41.0; >=3.0.0 <3.3.13

Identifiers

  • CVE-2026-118541
  • DRUPAL-CONTRIB-2026-256

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.