# CVE-2026-118544: Drupal Commerce Core information disclosure via JSON:API product variations

Source: https://junglewise.ai/threats/cve-2026-118544-drupal-contrib-2026-259-this-module-enables-you-to-sell-goods  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-118544 · Severity: info · Published 2026-10-30

Drupal Commerce is an e-commerce module that enables online sales through shopping carts and checkout forms. When the JSON:API module is enabled, an attacker can make repeated requests to determine field values on unpublished product variations, exposing sensitive product pricing and attribute data without proper authorization. This vulnerability requires both the Commerce and JSON:API modules to be enabled.

Technologies: [Drupal Commerce Core](https://junglewise.ai/threats/technologies/commerce-core), [Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce](https://junglewise.ai/threats/technologies/drupal-commerce). Vendors: [Drupal](https://junglewise.ai/threats/vendors/drupal), [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2026-118544 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118544 being exploited in the wild.

**How severe is CVE-2026-118544?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Drupal Commerce Core all versions before 2.41.0; all versions from 3.0.0 before 3.3.13; Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce ECOSYSTEM:introduced=0,fixed=2.41.0|ECOSYSTEM:introduced=3.0.0,fixed=3.3.13.

**Is there a fix for CVE-2026-118544?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 2.41.0 or later. Until then: Disable the JSON:API module if it is not required for your Drupal installation, as the vulnerability only manifests when both Commerce and JSON:API are enabled. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118544 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118544?** Check whether you run Drupal Commerce Core or Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Commerce: upgrade to 2.41.0 or later

Disable the JSON:API module if it is not required for your Drupal installation, as the vulnerability only manifests when both Commerce and JSON:API are enabled.

## Technical details

The Commerce module fails to adequately restrict product variations returned by entity queries based on user access permissions. When JSON:API is enabled, a network-based attacker can enumerate unpublished product variations and extract field values through repeated API requests. The vulnerability allows information disclosure of product data that should be access-restricted; no authentication is required to exploit it.

## Affected products

- Drupal Commerce Core all versions before 2.41.0; all versions from 3.0.0 before 3.3.13

## Identifiers

- CVE-2026-118544
- DRUPAL-CONTRIB-2026-259

## Timeline

- 2026-10-28: disclosed

## References

- [https://www.drupal.org/u/marcus_johansson](https://www.drupal.org/u/marcus_johansson)
- [https://www.drupal.org/sa-contrib-2026-259](https://www.drupal.org/sa-contrib-2026-259)

## Related threats

- [Drupal Commerce CSRF vulnerability in inbox routes](https://junglewise.ai/threats/cve-2026-118543-drupal-contrib-2026-258-this-module-enables-you-to-sell-goods)
- [Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.](https://junglewise.ai/threats/cve-2026-118542-drupal-contrib-2026-257-this-module-enables-you-to-sell-goods)
- [Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.](https://junglewise.ai/threats/cve-2026-118541-drupal-contrib-2026-256-this-module-enables-you-to-sell-goods)
- [Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.](https://junglewise.ai/threats/cve-2026-118540-drupal-contrib-2026-255-this-module-enables-you-to-sell-goods)
- [Drupal Commerce access bypass in entity and route protection](https://junglewise.ai/threats/cve-2026-118539-drupal-contrib-2026-254-this-module-enables-you-to-sell-goods)