View online: https://www.drupal.org/sa-contrib-2026-258 Project: Commerce Core [1] Project machine name: commerce Date: 2026-October-27 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site request forgery Affected versions: <2.41.0 || >=3.0.0 <3.3.13 CVE IDs: CVE-2026-118543 Description: This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates. Routes for the inbox do not check for a CSRF token. As a result, an attacker can trick a user with the "access commerce administration pages" permission into visiting a crafted page that will dismiss notifications for the messages. The inbox is also shared by all users, so if one commerce administrator is tricked, this hides the messages from every administrator, including notices that a security update is available. Solution: Install the latest version: * If you use version 3.x, upgrade to Commerce Core 3.3.13 [3]. * If you use an earlier version, upgrade to Commerce Core 8.x-2.41 [4]. Reported By: * Marcus Johansson (marcus_johansson) [5] * Ivo Van Geertruyen (mr.baileys) [6] of the Drupal Security Team Fixed By: * Jakub Piasecki (zaporylie) [7] * Jonathan Sacksick (jsacksick) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Jess (xjm) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_core/releases/3.3.13 [4] https://www.drupal.org/project/commerce_core/releases/8.x-2.41 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/mrbaileys [7] https://www.drupal.org/u/zaporylie [8] https://www.drupal.org/u/jsacksick [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/xjm [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....