Security AffairsPierluigi Paganini
Attackers exploit Drupal Commerce Core access control flaw
Part of the CVE-2026-118539 story · since 29 Oct
- Thu 29 Oct, 17:00 UTC. SecurityOnline, first report. Drupal Commerce flaw exploited to bypass access controls.
- Fri 30 Oct, 09:30 UTC. The Hacker News, its first report on the story. Attackers Exploit Drupal Commerce Core Authorisation Flaw.
- Fri 30 Oct, 12:00 UTC. SecurityWeek, its first report on the story. Drupal Commerce flaw exploited to bypass online store controls.
- Sat 31 Oct, 10:30 UTC. Security Affairs, its first report on the story. Attackers exploit Drupal Commerce Core access control flaw. This article, 4th of 4.
Drupal has warned that attackers are actively exploiting a critical authorization flaw in its Commerce Core module, tracked as CVE-2026-118539. The vulnerability arises from missing authorization checks, enabling forceful browsing of certain routes and entity fields and creating an access bypass with potential financial impact on vendors running affected sites. The Drupal advisory states the vulnerability is being exploited in the wild and affects Commerce Core versions from 0.0.0 to 2.41, and from 3.0.0 to 3.3.13.
Researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson), and Robert Snyder (rsnyd) reported the flaw, which the Drupal maintainers have confirmed is under active exploitation. Drupal’s guidance relies on upgrading to the latest Commerce Core release: users on the 3.x branch should move to version 3.3.13, while those on earlier releases should upgrade to Commerce Core 8.x-2.41.
The article notes that may also be relevant context from May, when Drupal warned of exploitation of an SQL injection flaw tracked as CVE-2026-9082 in the Drupal database abstraction API, though the current focus is CVE-2026-118539. The US CISA has previously added related Drupal flaws to its Known Exploited Vulnerabilities catalog, as cited in the piece.
How the story developed
4 articles from 4 outlets since 29 Oct. Still developing; the latest report was 1 hour ago. This was the 4th report, 2 days after the first.
- Thu 29 Oct, 17:00 UTC. SecurityOnline, first report. Drupal Commerce flaw exploited to bypass access controls.
- Fri 30 Oct, 09:30 UTC. The Hacker News, its first report on the story. Attackers Exploit Drupal Commerce Core Authorisation Flaw.
- Fri 30 Oct, 12:00 UTC. SecurityWeek, its first report on the story. Drupal Commerce flaw exploited to bypass online store controls.
- Sat 31 Oct, 10:30 UTC. Security Affairs, its first report on the story. Attackers exploit Drupal Commerce Core access control flaw. This article, 4th of 4.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 4 articles as a listHide the list
- Thu 29 OctDay 01
- Drupal Commerce flaw exploited to bypass access controls17:00 · SecurityOnline · First report
- Fri 30 OctDay 12
- Attackers Exploit Drupal Commerce Core Authorisation Flaw09:30 · The Hacker News
- Drupal Commerce flaw exploited to bypass online store controls12:00 · SecurityWeek
- Sat 31 OctDay 21
- Attackers exploit Drupal Commerce Core access control flaw10:30 · Security Affairs · This article, 4th of 4