View online: https://www.drupal.org/sa-contrib-2026-179 Project: Commerce Decoupled Checkout [1] Project machine name: commerce_decoupled_checkout Date: 2026-September-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: >=1.0.0 <1.8.0 CVE IDs: CVE-2026-96378 Description: This module enables REST endpoints for a decoupled Commerce experience which allow for remote order creation. The module doesn't sufficiently sanitize order data passed into the order creation endpoint, which allows for potentially unsafe order properties to be set on an order. Solution: Install the latest version of the module: * Update to Commerce Decoupled Checkout 8.x-1.8 [3]. The standard order fields type, email, store, and order_items remain accepted by default. Sites submitting additional custom order fields must explicitly enable them at /admin/commerce/config/decoupled-checkout. Requests containing fields outside this allowlist will be rejected. Run database updates and configure the required customer-writable fields before resuming checkout. Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Leo Pitt (leo pitt) [5] * Marcus Johansson (marcus_johansson) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/commerce_decoupled_checkout [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_decoupled_checkout/releases/8.x-1.8 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/leo-pitt [6] https://www.drupal.org/u/marcus_johansson [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/xjm [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....