View online: https://www.drupal.org/sa-contrib-2026-259 Project: Commerce Core [1] Project machine name: commerce Date: 2026-October-27 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Proof/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <2.41.0 || >=3.0.0 <3.3.13 CVE IDs: CVE-2026-118544 Description: This module enables you to sell goods and services to customers through a shopping cart and checkout form. The module doesn't sufficiently restrict the product variations returned by entity queries to the variations the current user can view. When the core JSON:API module is enabled, a visitor can make repeated requests that eventually determine certain field values on an unpublished product variation, or a variation of an unpublished product. This vulnerability is mitigated by the fact that the core JSON:API module must be enabled. Solution: Install the latest version: * If you use Commerce 3.x, upgrade to Commerce 3.3.13 [3] * If you use Commerce 2.x, upgrade to Commerce 8.x-2.41 [4] Reported By: * Marcus Johansson [5] Fixed By: * Jonathan Sacksick (jsacksick) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce/releases/3.3.13 [4] https://www.drupal.org/project/commerce/releases/8.x-2.41 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/jsacksick [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....