Drupal Commerce Core Authorization Bypass Exploited in the Wild, Over 42,000 Stores Exposed (CVE-2026-118539)

Scope: Drupal Commerce Core, versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13

Severity: Red

The Drupal Security Team published advisory SA-CONTRIB-2026-254 on October 28, 2026, rating a flaw in the Commerce Core module “Highly critical” at 21 out of 25 on Drupal’s risk scale, and confirming active exploitation in the wild. Commerce Core is the module that powers shopping carts, checkout, and API-driven storefronts on Drupal sites, used by more than 42,000 websites including Fortune 500 companies and research universities. The vulnerability stems from certain routes and entity fields not being properly protected by authorization checks, letting a completely unauthenticated attacker bypass access controls. Drupal’s own advisory describes the impact plainly: the flaw “may financially impact the vendor,” which in practical terms means order tampering, fraud, or unauthorized access to commerce data on a live storefront. Researchers Dan Puccetti, Marcus Johansson, and Robert Snyder reported the issue, and two related Commerce Core flaws were patched in the same release cycle, a promotion and coupon access bypass (CVE-2026-118541) and a default-store access bypass affecting multi-store sites (CVE-2026-118542). Drupal has had five vulnerabilities land on CISA’s exploited list over the past several years, two of them abused by ransomware gangs, so this ecosystem has a real track record attackers return to. Organisations running Drupal Commerce must upgrade to Commerce Core 3.3.13 on the 3.x branch, or 8.x-2.41 on earlier branches, today, and should audit existing store orders for inconsistencies given that exploitation was already underway before the patch existed.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.