View online: https://www.drupal.org/sa-contrib-2026-255 Project: Commerce Core [1] Project machine name: commerce Date: 2026-July-17 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information disclosure Affected versions: <2.41 || >=3.0.0 <3.2.0 CVE IDs: CVE-2026-118540 Description:  This module enables you to sell goods and services to customers through a shopping cart and checkout form. When Drupal Commerce is used with the JSON:API module, it is possible for unpublished product variations to be accessible to users without permission. This vulnerability is mitigated by only affecting sites with published products and unpublished product variations. Solution:  Install the latest version: * If you use Commerce Core 3.2.x or lower, upgrade to Commerce Core 3.3.13 [3]. * If you use Commerce Core 8.x upgrade to Commerce Core 8.x-2.41 [4]. Commerce Core 3.3.x is not affected by this vulnerability. Reported By:  * Matt Glaman (mglaman) [5] Fixed By:  * Julian Pustkuchen (anybody) [6] * Jonathan Sacksick (jsacksick) [7] * Matt Glaman (mglaman) [8] Coordinated By:  * Swan Kalata (akalata) [9] of the Drupal Security Team * Bram Driesen (bramdriesen) [10] of the Drupal Security Team * Mori Sugimoto (dokumori) [11] of the Drupal Security Team * Neil Drumm (drumm) [12] of the Drupal Security Team * Greg Knaddison (greggles) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team * Jess (xjm) [15] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [16] [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/commerce/releases/3.3.13 [4] https://www.drupal.org/project/commerce/releases/8.x-2.41 [5] https://www.drupal.org/u/mglaman [6] https://www.drupal.org/u/anybody [7] https://www.drupal.org/u/jsacksick [8] https://www.drupal.org/u/mglaman [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/bramdriesen [11] https://www.drupal.org/u/dokumori [12] https://www.drupal.org/u/drumm [13] https://www.drupal.org/u/greggles [14] https://www.drupal.org/u/poker10 [15] https://www.drupal.org/u/xjm [16] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....