Drupal warns of actively exploited access bypass flaw in Commerce Core module

Drupal warned administrators in a Wednesday security advisory (SA-CONTRIB-2026-254) to patch a highly critical access bypass vulnerability in its Commerce Core module that threat actors are actively exploiting in the wild. Tracked as CVE-2026-118539, the flaw stems from a missing authorisation weakness that unauthenticated attackers can abuse, though the open-source content management framework provided no specifics on the nature or extent of the campaign.

The vulnerability affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13, and carries no assigned CVSS score. According to the advisory, the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor." Commerce Core is a community-developed framework used by more than 42,000 websites, including Fortune 500 companies and research universities, to sell goods and services through an included shopping cart and checkout form or via APIs for decoupled applications.

Drupal credited researchers Dan Puccetti, Marcus Johansson and Robert Snyder with reporting the flaw. Work on the release was carried out by volunteers from the Drupal Security Team, with sponsored time contributed by the Colorado Governor's Office of Information Technology's Colorado Digital Service.

The advisory follows other recent Drupal security warnings. Two weeks ago, Drupal patched two remote code execution vulnerabilities (CVE-2026-108097 and CVE-2026-108099) and urged administrators to apply updates as soon as possible because attackers could develop exploits "within hours or days." In May, Drupal also warned of active exploitation targeting an SQL injection flaw (CVE-2026-9082) in its database abstraction API, which the US Cybersecurity and Infrastructure Security Agency (CISA) subsequently added to its Known Exploited Vulnerabilities (KEV) Catalog, ordering federal agencies to patch within three days.

To address CVE-2026-118539, the Drupal Security Team advised administrators running the 3.x branch to upgrade immediately to Commerce Core 3.3.13, while those using earlier versions should update to Commerce Core 8.x-2.41. Because the vulnerability is actively exploited in attacks, Drupal also instructed site operators to audit their orders for inconsistencies.

Sources: Drupal.org, BleepingComputer, The Hacker News

Written with AI and fact-checked against the linked sources by an automated AI review before publication. Spotted an error? See our Corrections Policy.