CVE-2026-118539

CVE Enrichment

CISA KEV: Not listed

Description

Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

Technical Details

CNA / NVD Source: [email protected]
Published: 30-Oct-2026 11:18
Last Modified: 30-Oct-2026 11:18
CWE: CWE-862

References

[email protected]

Last enrichment sync: 30-Oct-2026 16:58
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

Tracked as CVE-2026-118539, the issue affects a contributed module that adds e-commerce features to Drupal websites, including a shopping cart and checkout process. Drupal Commerce Core Access Bypass Exploited in the Wild
The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. Drupal Commerce Core Authorization Bypass Flaw Actively Exploited
Tracked as CVE-2026-118539, this flaw stems from a missing authorization weakness that can be abused by unauthenticated attackers and affects Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Drupal Warns of Actively Exploited Commerce Core Access Bypass

CVE (5)

People (7)

MITRE ATT&CK (1)

Vendors (1)

Products (3)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.