# CVE-2026-118541: Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.

Source: https://junglewise.ai/threats/cve-2026-118541-drupal-contrib-2026-256-this-module-enables-you-to-sell-goods  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-118541 · Severity: info · Published 2026-10-30

Drupal Commerce is an e-commerce module that manages shopping carts, checkout, promotions, and coupons. A user with permission to manage only their own promotions can bypass access controls to delete or modify coupons belonging to other promotions. The vulnerability requires JSON:API or REST to be enabled for exploitation, which is not the default configuration.

Technologies: [Drupal Commerce Core](https://junglewise.ai/threats/technologies/commerce-core), [Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce](https://junglewise.ai/threats/technologies/drupal-commerce). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-118541 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118541 being exploited in the wild.

**How severe is CVE-2026-118541?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Drupal Commerce Core <2.41.0; >=3.0.0 <3.3.13; Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce ECOSYSTEM:introduced=0,fixed=2.41.0|ECOSYSTEM:introduced=3.0.0,fixed=3.3.13.

**Is there a fix for CVE-2026-118541?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 2.41.0 or later. Until then: Ensure JSON:API and REST APIs are not enabled unless required for your site's functionality. If these APIs must be active, restrict write access to trusted roles only.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-28"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118541 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118541?** Check whether you run Drupal Commerce Core or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 2.41.0 or later

Ensure JSON:API and REST APIs are not enabled unless required for your site's functionality. If these APIs must be active, restrict write access to trusted roles only.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-28"}]

## Technical details

An insufficient access control check in the promotion-coupon relationship allows privilege escalation. A user with limited promotion management permissions can manipulate coupons outside their scope via JSON:API or REST endpoints. The flaw is mitigated by default since these APIs are disabled by default in Drupal installations.

## Affected products

- Drupal Commerce Core <2.41.0; >=3.0.0 <3.3.13

## Identifiers

- CVE-2026-118541
- DRUPAL-CONTRIB-2026-256

## References

- [https://www.drupal.org/user/385947](https://www.drupal.org/user/385947)
- [https://www.drupal.org/sa-contrib-2026-256](https://www.drupal.org/sa-contrib-2026-256)

## Related threats

- [Drupal Commerce Core information disclosure via JSON:API product variations](https://junglewise.ai/threats/cve-2026-118544-drupal-contrib-2026-259-this-module-enables-you-to-sell-goods)
- [Drupal Commerce CSRF vulnerability in inbox routes](https://junglewise.ai/threats/cve-2026-118543-drupal-contrib-2026-258-this-module-enables-you-to-sell-goods)
- [Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.](https://junglewise.ai/threats/cve-2026-118542-drupal-contrib-2026-257-this-module-enables-you-to-sell-goods)
- [Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.](https://junglewise.ai/threats/cve-2026-118540-drupal-contrib-2026-255-this-module-enables-you-to-sell-goods)
- [Drupal Commerce access bypass in entity and route protection](https://junglewise.ai/threats/cve-2026-118539-drupal-contrib-2026-254-this-module-enables-you-to-sell-goods)