Attackers Exploit Drupal Commerce Core Authorisation Flaw

Drupal has warned that attackers are actively exploiting a highly critical flaw in its Commerce Core module. The vulnerability, tracked as CVE-2026-118539, is described as a missing authorisation issue that affects Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.

Drupal notes that the module “enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs,” but does not sufficiently protect certain routes and entity fields, resulting in an access bypass with possible financial impact on the vendor. The advisory states that the vulnerability is being actively exploited in the wild, though it does not provide specifics about the nature of the exploitation or the scope of campaigns.

The recommended mitigations are straightforward: upgrade to Commerce Core 3.3.13 for the 3.x line, or upgrade to Commerce Core 2.41 for the 0.x/2.41 path (listed as 8.x-2.41 in the advisory for earlier versions). Drupal attributes the report to researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson), and Robert Snyder (rsnyd). The announcement emphasises the ongoing exploitation and urges users to apply the latest fixes to prevent further risk. No further technical specifics about the attack are provided by Drupal in the published advisory.