October 2026 - Security-news - lists.drupal.org

Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-262 Project: Commerce Shipping [1] Project machine name: commerce_shipping Date: 2026-October-28 Security risk: *Less critical* 8 ∕ 25 AC:Basic/A:Admin/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <2.16.0 || >=3.0.0 <3.0.6 CVE IDs: CVE-2026-118557 Description: This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment. The module doesn't sufficiently check access on the form to resend receipts. Under certain configurations, this allows some users to gain access to receipts and customer information for orders they should not be able to access. Solution: Install the latest version: * If you use Commerce Shipping 3.0.x, upgrade to Commerce Shipping 3.0.6 [3]. * If you use Commerce Shipping 8.x-2.x, upgrade to Commerce Shipping 8.x-2.16 [4]. Reported By: * Jakub Piasecki (zaporylie) [5] Fixed By: * Jonathan Sacksick (jsacksick) [6] * Jakub Piasecki (zaporylie) [7] Coordinated By: * Swan Kalata (akalata) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/commerce_shipping [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_shipping/releases/3.0.6 [4] https://www.drupal.org/project/commerce_shipping/releases/8.x-2.16 [5] https://www.drupal.org/u/zaporylie [6] https://www.drupal.org/u/jsacksick [7] https://www.drupal.org/u/zaporylie [8] https://www.drupal.org/u/akalata [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-261 Project: Commerce Shipping [1] Project machine name: commerce_shipping Date: 2026-October-28 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <2.16.0 || >=3.0.0 <3.0.6 CVE IDs: CVE-2026-118556 Description: This module enables you to sell tangible products via Drupal Commerce that are organized into shipments for fulfillment. The module doesn't sufficiently protect shipment references and shipment entity fields, leading to an access bypass that can result in inappropriately modified shipment states or deleted shipments. This vulnerability is mitigated by the fact that an attacker must have a cart with API-based access to manipulate its shipments. Solution: Install the latest version: * If you use Commerce Shipping 3.0.x, upgrade to Commerce Shipping 3.0.6 [3]. * If you use Commerce Shipping 8.x-2.x, upgrade to Commerce Shipping 8.x-2.16 [4]. Reported By: * Jakub Piasecki (zaporylie) [5] Fixed By: * Jonathan Sacksick (jsacksick) [6] * Jakub Piasecki (zaporylie) [7] * Tom Ashe (tomtech) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/commerce_shipping [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_shipping/releases/3.0.6 [4] https://www.drupal.org/project/commerce_shipping/releases/8.x-2.16 [5] https://www.drupal.org/u/zaporylie [6] https://www.drupal.org/u/jsacksick [7] https://www.drupal.org/u/zaporylie [8] https://www.drupal.org/u/tomtech [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-260 Project: Commerce License [1] Project machine name: commerce_license Date: 2026-October-27 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <3.1.1 CVE IDs: CVE-2026-118555 Description: This module enables you to sell licenses granting access to resources, such as user roles, files, or protected content. The module doesn't sufficiently restrict access to license fields for users with the "update own commerce_license" permission. A license owner can change the rights granted by their license and the license state, which can result in privilege escalation, up to the Administrator role for the site. This vulnerability is mitigated by the fact that an attacker must own a license, and have a role with the "update own commerce_license" permission, which is not granted by default. Solution: Install the latest version: * If you use the Commerce License module for Drupal 10 or 11, upgrade to Commerce License 3.1.1 [3]. Sites that granted the "update own commerce_license" permission should review role licenses for unexpected roles, and review which users hold administrative roles. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Jonathan Sacksick (jsacksick) [5] * Tom Ashe (tomtech) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/commerce_license [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_license/releases/3.1.1 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/jsacksick [6] https://www.drupal.org/u/tomtech [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-259 Project: Commerce Core [1] Project machine name: commerce Date: 2026-October-27 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Proof/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <2.41.0 || >=3.0.0 <3.3.13 CVE IDs: CVE-2026-118544 Description: This module enables you to sell goods and services to customers through a shopping cart and checkout form. The module doesn't sufficiently restrict the product variations returned by entity queries to the variations the current user can view. When the core JSON:API module is enabled, a visitor can make repeated requests that eventually determine certain field values on an unpublished product variation, or a variation of an unpublished product. This vulnerability is mitigated by the fact that the core JSON:API module must be enabled. Solution: Install the latest version: * If you use Commerce 3.x, upgrade to Commerce 3.3.13 [3] * If you use Commerce 2.x, upgrade to Commerce 8.x-2.41 [4] Reported By: * Marcus Johansson [5] Fixed By: * Jonathan Sacksick (jsacksick) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce/releases/3.3.13 [4] https://www.drupal.org/project/commerce/releases/8.x-2.41 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/jsacksick [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-258 Project: Commerce Core [1] Project machine name: commerce Date: 2026-October-27 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site request forgery Affected versions: <2.41.0 || >=3.0.0 <3.3.13 CVE IDs: CVE-2026-118543 Description: This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates. Routes for the inbox do not check for a CSRF token. As a result, an attacker can trick a user with the "access commerce administration pages" permission into visiting a crafted page that will dismiss notifications for the messages. The inbox is also shared by all users, so if one commerce administrator is tricked, this hides the messages from every administrator, including notices that a security update is available. Solution: Install the latest version: * If you use version 3.x, upgrade to Commerce Core 3.3.13 [3]. * If you use an earlier version, upgrade to Commerce Core 8.x-2.41 [4]. Reported By: * Marcus Johansson (marcus_johansson) [5] * Ivo Van Geertruyen (mr.baileys) [6] of the Drupal Security Team Fixed By: * Jakub Piasecki (zaporylie) [7] * Jonathan Sacksick (jsacksick) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_core/releases/3.3.13 [4] https://www.drupal.org/project/commerce_core/releases/8.x-2.41 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/mrbaileys [7] https://www.drupal.org/u/zaporylie [8] https://www.drupal.org/u/jsacksick [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-257 Project: Commerce Core [1] Project machine name: commerce Date: 2026-October-27 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:Admin/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.41.0 || >=3.0.0 <3.3.13 CVE IDs: CVE-2026-118542 Description: This module enables you to sell goods and services to customers through a shopping cart and checkout form. Sites can also create multiple online stores that are managed by different users. The module doesn't check access properly when a store is saved. A user who can either create stores or edit their own store is able to mark their store as the site's default store. This causes their store to get some orders they normally shouldn't. Only sites that give those permissions to untrusted users are affected (for example, marketplace sites where vendors manage their own stores). Solution: Install the latest version: * If you use version 3.x, upgrade to Commerce Core 3.3.13 [3]. * If you use an earlier version, upgrade to Commerce Core 8.x-2.41 [4]. Reported By: * Marcus Johansson (marcus_johansson) [5] Fixed By: * Jonathan Sacksick (jsacksick) [6] * Tom Ashe (tomtech) [7] * Jakub Piasecki (zaporylie) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_core/releases/3.3.13 [4] https://www.drupal.org/project/commerce_core/releases/8.x-2.41 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/jsacksick [7] https://www.drupal.org/u/tomtech [8] https://www.drupal.org/u/zaporylie [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-256 Project: Commerce Core [1] Project machine name: commerce Date: 2026-October-27 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <2.41.0 || >=3.0.0 <3.3.13 CVE IDs: CVE-2026-118541 Description: This module enables you to sell goods and services to customers through a shopping cart and checkout form. It includes a feature to manage promotions and the coupons that apply them. The module doesn't sufficiently check access to the relationship between promotions and coupons. A user who is only allowed to manage their own promotions can delete or change coupons that belong to other promotions. This vulnerability is mitigated by the fact that the site must accept writes through JSON:API or REST, which is not enabled by default. Solution: Install the latest version: * If you use Commerce Core 3.x, upgrade to Commerce Core 3.3.13 [3]. * If you use Commerce Core 8.x-2.x, upgrade to Commerce Core 8.x-2.41 [4]. Reported By: * Marcus Johansson (Marcus_Johansson) [5] Fixed By: * Jonathan Sacksick (jsacksick) [6] * Jakub Piasecki (zaporylie) [7] * Tom Ashe (TomTech) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce/releases/3.3.13 [4] https://www.drupal.org/project/commerce/releases/8.x-2.41 [5] https://www.drupal.org/user/385947 [6] https://www.drupal.org/user/972218 [7] https://www.drupal.org/u/zaporylie [8] https://www.drupal.org/user/254986 [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-255 Project: Commerce Core [1] Project machine name: commerce Date: 2026-July-17 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information disclosure Affected versions: <2.41 || >=3.0.0 <3.2.0 CVE IDs: CVE-2026-118540 Description: This module enables you to sell goods and services to customers through a shopping cart and checkout form. When Drupal Commerce is used with the JSON:API module, it is possible for unpublished product variations to be accessible to users without permission. This vulnerability is mitigated by only affecting sites with published products and unpublished product variations. Solution: Install the latest version: * If you use Commerce Core 3.2.x or lower, upgrade to Commerce Core 3.3.13 [3]. * If you use Commerce Core 8.x upgrade to Commerce Core 8.x-2.41 [4]. Commerce Core 3.3.x is not affected by this vulnerability. Reported By: * Matt Glaman (mglaman) [5] Fixed By: * Julian Pustkuchen (anybody) [6] * Jonathan Sacksick (jsacksick) [7] * Matt Glaman (mglaman) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * Mori Sugimoto (dokumori) [11] of the Drupal Security Team * Neil Drumm (drumm) [12] of the Drupal Security Team * Greg Knaddison (greggles) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team * Jess (xjm) [15] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [16] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce/releases/3.3.13 [4] https://www.drupal.org/project/commerce/releases/8.x-2.41 [5] https://www.drupal.org/u/mglaman [6] https://www.drupal.org/u/anybody [7] https://www.drupal.org/u/jsacksick [8] https://www.drupal.org/u/mglaman [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/dokumori [12] https://www.drupal.org/u/drumm [13] https://www.drupal.org/u/greggles [14] https://www.drupal.org/u/poker10 [15] https://www.drupal.org/u/xjm [16] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-254 Project: Commerce Core [1] Project machine name: commerce Date: 2026-October-22 Security risk: *Highly critical* 21 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All [2] Vulnerability: Access bypass Affected versions: <2.41 || >=3.0.0 <3.2.0 CVE IDs: CVE-2026-118539 Description: This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs. The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. This vulnerability is being actively exploited in the wild. Solution: Install the latest version: * If you use version 3.x, upgrade to Commerce Core 3.3.13 [3]. * If you use an earlier version, upgrade to Commerce Core 8.x-2.41 [4]. *Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited.* Reported By: * Dan Puccetti (dpuccetti) [5] * Marcus Johansson (marcus_johansson) [6] * Robert Snyder (rsnyd) [7] Fixed By: * Jonathan Sacksick (jsacksick) [8] * Lee Rowlands (larowlan) [9] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [10] provisional member of the Drupal Security Team * Ryan Szrama (rszrama) [11] * Tom Ashe (tomtech) [12] * Jakub Piasecki (zaporylie) [13] Coordinated By: * Swan Kalata (akalata) [14] of the Drupal Security Team * Bram Driesen (bramdriesen) [15] of the Drupal Security Team * Damien McKenna (damienmckenna) [16] of the Drupal Security Team * Greg Knaddison (greggles) [17] of the Drupal Security Team * Juraj Nemec (poker10) [18] of the Drupal Security Team * Vijay Mani (vijaycs85) [19] * Jess (xjm) [20] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [21] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce/releases/3.3.13 [4] https://www.drupal.org/project/commerce/releases/8.x-2.41 [5] https://www.drupal.org/u/dpuccetti [6] https://www.drupal.org/u/marcus_johansson [7] https://www.drupal.org/u/rsnyd [8] https://www.drupal.org/u/jsacksick [9] https://www.drupal.org/u/larowlan [10] https://www.drupal.org/u/mohit_aghera [11] https://www.drupal.org/u/rszrama [12] https://www.drupal.org/u/tomtech [13] https://www.drupal.org/u/zaporylie [14] https://www.drupal.org/u/akalata [15] https://www.drupal.org/u/bramdriesen [16] https://www.drupal.org/u/damienmckenna [17] https://www.drupal.org/u/greggles [18] https://www.drupal.org/u/poker10 [19] https://www.drupal.org/u/vijaycs85 [20] https://www.drupal.org/u/xjm [21] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253
by security-news＠drupal.org 21 Oct '26

21 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-253 Project: Monster Menus [1] Project machine name: monster_menus Date: 2026-October-21 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: PHP object injection Affected versions: <9.5.6 CVE IDs: CVE-2026-114573 Description: This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule allows you to create nodes which aggregate one or more RSS feeds. When the input of the node creation form is processed, it makes use of PHP's unserialize function. This introduces a PHP object injection vulnerability. This vulnerability is mitigated by the fact that the RSS Page submodule must be enabled and an attacker must have a role with the permission "RSS Feed: Create new content". Solution: Install the latest version: * If you use the monster_menus module, upgrade to monster_menus 9.5.6 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Dan Wilga (gribnif) [5] Coordinated By: * Drew Webber (mcdruid) [6] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [7] [1] https://www.drupal.org/project/monster_menus [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/monster_menus/releases/9.5.6 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/gribnif [6] https://www.drupal.org/u/mcdruid [7] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0