Drupal Commerce flaw exploited to bypass access controls

Drupal has confirmed that a high‑severity access bypass in Commerce Core, tracked as CVE-2026-118539, is being exploited in the wild. The advisory SA-CONTRIB-2026-254 states that this flaw “is being actively exploited,” with the Drupal security team rating the risk as highly critical (score 21/25 on the Drupal risk scale). The vulnerability arises because Commerce Core does not sufficiently protect certain routes and entity fields, allowing unauthenticated access bypass on affected sites.

The advisory notes an exploit status of “Exploit” and warns that the bug can impact any site configuration, with confidentiality and integrity impacts listed as “Some.”

Affected versions include Commerce Core before 8.x-2.41 and before 3.3.13 on the 3.x branch. Drupal recommends upgrading to Commerce Core 3.3.13 or 8.x-2.41, respectively, and auditing orders for inconsistencies since attackers are already abusing the flaw to affect store revenue. The Drupal project page indicates roughly 42,000 sites report use of Commerce Core, underscoring the potential reach of the exploitation.

The advisory does not publish further technical details beyond stating the module “doesn’t sufficiently protect certain routes and entity fields,” and credits disclosures from Dan Puccetti, Marcus Johansson and Robert Snyder. As practical steps, sites should apply the specified patches and review recent orders for unexpected prices, totals or status changes, aligning with the guidance to audit for inconsistencies while exploitation continues.