Drupal Commerce Core authorization bypass actively exploited (CVE-2026-118539)

What happened

On 30 October 2026 the Drupal security team published advisory SA-CONTRIB-2026-254 for Commerce Core, the contributed module that powers most Drupal-based web shops. The vulnerability, tracked as CVE-2026-118539, is a missing authorization check that allows forceful browsing. An attacker can open pages or functions directly by URL that should only be available to users with the right permissions.

Active exploitation was confirmed on the same day the vulnerability became public. Shops that have not yet updated are at immediate risk.

Who is affected

The vulnerability affects every Drupal site with Commerce Core installed in one of these versions:

• Commerce Core up to version 2.41
• Commerce Core from version 3.0.0 to 3.3.13

Drupal core itself is not named as affected. The risk comes from the Commerce Core module. If you manage Drupal shops for customers, check each site individually, because module versions often differ between installations.

What to do now

1. Find out which Commerce Core version each site runs, for example with composer show drupal/commerce or drush pm:list | grep -i commerce.
2. Back up the database and the codebase, including composer.json and composer.lock.
3. Look up the fixed release for your branch in the Drupal advisory SA-CONTRIB-2026-254 linked below. The fixed version numbers are not included in our source data, so do not rely on a guessed version.
4. Update the module, for example with composer update drupal/commerce --with-dependencies, then deploy the updated code.
5. Run pending database updates and clear the cache: drush updatedb and drush cache:rebuild.
6. Test the shop: product pages, cart, checkout, payment and the administration pages for orders and stores.
7. If you cannot update immediately, consider putting the shop into maintenance mode until the update is installed.

How to check whether you are affected

• Version check: any Commerce Core version up to 2.41, or from 3.0.0 to 3.3.13, is vulnerable.
• Access logs: review the web server access logs since before 30 October 2026. Look for requests to Commerce-related administrative or order routes that come from anonymous visitors or from accounts that should not have access to them.
• Drupal logs: check the recent log messages (/admin/reports/dblog or drush watchdog:show) for unusual activity.
• Shop data: look for orders, prices, products, store settings or payment configuration that changed without explanation. Also check for user accounts or role changes that nobody on your team made.
• If you find signs of misuse: preserve the logs, rotate administrator and API credentials, and inform the shop owner. Depending on what data was accessed, data protection notification duties may apply.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-118539
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog