CVE-2026-118539
Drupal Commerce Core access bypass lets attackers place fraudulent orders (SA-CONTRIB-2026-254)
A missing authorization check in the contributed Drupal Commerce Core module (commerce) lets unauthenticated users reach order routes and fields they should not. Drupal rates it Highly critical 21/25 and says it is actively exploited. The maintainer received two merchant reports of fraudulent order attempts. Fixed in 3.3.13 and 8.x-2.41 on 28 October 2026. Not Drupal core. No CVSS score yet. Not in CISA KEV. No public PoC found.
By ThreatWire Desk · Published 28 Oct 2026 · Updated 30 Oct 2026
- CVSS
- Unknown
- Vector
- Not recorded
- Class
- Auth bypass
- Status
- Active Exploitation
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Drupal (Commerce Core contributed module, maintained by Centarro)
- Products
- Drupal Commerce Core (commerce)
- Affected
- Commerce Core 8.x-2.x before 8.x-2.41, and 3.0.0 up to but not including 3.3.13. The maintainer says the flaw was possible since 8.x-2.18 (26 May 2020) on sites using the JSON:API module, and since 8.x-2.25 (30 June 2021) for all other sites.
- Fixed
- Commerce Core 3.3.13 and 8.x-2.41 (28 October 2026). Updating Drupal core does not fix it. Centarro also shipped same-day security releases for Commerce API, Commerce License, Commerce Shipping and Commerce Stripe.
- CWE
- CWE-862
- Published
- 28 Oct 2026
- Updated
- 30 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-118539 is an access bypass in Commerce Core, the contributed Drupal module behind Drupal Commerce. It is not part of Drupal core. Updating Drupal core does not fix it.
The Drupal Security Team published it as SA-CONTRIB-2026-254 on 28 October 2026. The CVE record went public on 30 October. Drupal.org is the CVE issuer. The weakness is CWE-862, Missing Authorization.
Drupal rates it Highly critical 21/25. That is Drupal's own scale, not CVSS. Its risk vector says no login is needed and an exploit exists. NVD has not analysed the CVE, so there is no CVSS score yet.
The advisory says the module does not protect certain routes and entity fields well enough. The result is an access bypass "that may financially impact the vendor". The advisory says the flaw "is being actively exploited in the wild".
Centarro, which maintains the module, received two reports from merchants. Both saw attempts to place fraudulent orders. Some orders had obviously wrong prices, such as $0.01. Others had normal prices. Centarro and the Drupal Security Team say they do not believe it was scripted or exploited beyond those first sites.
Affected: 8.x-2.x before 8.x-2.41, and 3.x before 3.3.13. Centarro says the flaw was possible since 8.x-2.18 (May 2020) on sites using JSON:API, and since 8.x-2.25 (June 2021) on all others. Full-stack and headless sites are both exposed, through different routes.
Fixed: 3.3.13 and 8.x-2.41. The same releases also fix SA-CONTRIB-2026-255 to -259, which Drupal rates moderately critical or lower.
The CVE is not in the CISA KEV catalog (catalog 2026.10.30). ThreatWire found no public PoC. No attacker, indicator or request detail has been published.
What to do: update Commerce Core now. Update Commerce API, License, Shipping and Stripe at the same time if you use them. Then audit recent orders, as Drupal and Centarro advise. See our explainer for the audit checklist.