View online: https://www.drupal.org/sa-contrib-2026-254 Project: Commerce Core [1] Project machine name: commerce Date: 2026-October-22 Security risk: *Highly critical* 21 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All [2] Vulnerability: Access bypass Affected versions: <2.41 || >=3.0.0 <3.2.0 CVE IDs: CVE-2026-118539 Description: This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs. The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor. This vulnerability is being actively exploited in the wild. Solution: Install the latest version: * If you use version 3.x, upgrade to Commerce Core 3.3.13 [3]. * If you use an earlier version, upgrade to Commerce Core 8.x-2.41 [4]. *Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited.* Reported By: * Dan Puccetti (dpuccetti) [5] * Marcus Johansson (marcus_johansson) [6] * Robert Snyder (rsnyd) [7] Fixed By: * Jonathan Sacksick (jsacksick) [8] * Lee Rowlands (larowlan) [9] of the Drupal Security Team * Mohit Aghera (mohit_aghera) [10] provisional member of the Drupal Security Team * Ryan Szrama (rszrama) [11] * Tom Ashe (tomtech) [12] * Jakub Piasecki (zaporylie) [13] Coordinated By: * Swan Kalata (akalata) [14] of the Drupal Security Team * Bram Driesen (bramdriesen) [15] of the Drupal Security Team * Damien McKenna (damienmckenna) [16] of the Drupal Security Team * Greg Knaddison (greggles) [17] of the Drupal Security Team * Juraj Nemec (poker10) [18] of the Drupal Security Team * Vijay Mani (vijaycs85) [19] * Jess (xjm) [20] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [21] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce/releases/3.3.13 [4] https://www.drupal.org/project/commerce/releases/8.x-2.41 [5] https://www.drupal.org/u/dpuccetti [6] https://www.drupal.org/u/marcus_johansson [7] https://www.drupal.org/u/rsnyd [8] https://www.drupal.org/u/jsacksick [9] https://www.drupal.org/u/larowlan [10] https://www.drupal.org/u/mohit_aghera [11] https://www.drupal.org/u/rszrama [12] https://www.drupal.org/u/tomtech [13] https://www.drupal.org/u/zaporylie [14] https://www.drupal.org/u/akalata [15] https://www.drupal.org/u/bramdriesen [16] https://www.drupal.org/u/damienmckenna [17] https://www.drupal.org/u/greggles [18] https://www.drupal.org/u/poker10 [19] https://www.drupal.org/u/vijaycs85 [20] https://www.drupal.org/u/xjm [21] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....