View online: https://www.drupal.org/sa-contrib-2026-302 Project: Commerce Escrow [1] Project machine name: commerce_escrow Date: 2026-November-04 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.1.0 CVE IDs: CVE-2026-122071 Description:  This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are in progress. Solution:  Install the latest version: * Upgrade to Commerce Escrow 1.1.0 [3]. (1.0.x versions are no longer supported.) After updating, register the new webhook URL with Escrow.com. It is shown on the configuration form of each Escrow payment gateway. Reported By:  * Marcus Johansson (marcus_johansson) [4] Fixed By:  * Valentino Međimorec (valic) [5] Coordinated By:  * Swan Kalata (akalata) [6] of the Drupal Security Team * Bram Driesen (bramdriesen) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/commerce_escrow [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce_escrow/releases/1.1.0 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/valic [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/bramdriesen [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/xjm [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....