View online: https://www.drupal.org/sa-contrib-2026-256 Project: Commerce Core [1] Project machine name: commerce Date: 2026-October-27 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <2.41.0 || >=3.0.0 <3.3.13 CVE IDs: CVE-2026-118541 Description: This module enables you to sell goods and services to customers through a shopping cart and checkout form. It includes a feature to manage promotions and the coupons that apply them. The module doesn't sufficiently check access to the relationship between promotions and coupons. A user who is only allowed to manage their own promotions can delete or change coupons that belong to other promotions. This vulnerability is mitigated by the fact that the site must accept writes through JSON:API or REST, which is not enabled by default. Solution: Install the latest version: * If you use Commerce Core 3.x, upgrade to Commerce Core 3.3.13 [3]. * If you use Commerce Core 8.x-2.x, upgrade to Commerce Core 8.x-2.41 [4]. Reported By: * Marcus Johansson (Marcus_Johansson) [5] Fixed By: * Jonathan Sacksick (jsacksick) [6] * Jakub Piasecki (zaporylie) [7] * Tom Ashe (TomTech) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce/releases/3.3.13 [4] https://www.drupal.org/project/commerce/releases/8.x-2.41 [5] https://www.drupal.org/user/385947 [6] https://www.drupal.org/user/972218 [7] https://www.drupal.org/u/zaporylie [8] https://www.drupal.org/user/254986 [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....