CVE-2026-118539: Drupal Commerce Core Authorization Bypass Exploited in the Wild

Overview

Drupal has warned that attackers are actively exploiting a "highly critical" flaw in the Commerce Core module. Tracked as CVE-2026-118539 (Drupal advisory SA-contrib-2026-254), it is a missing-authorization issue: the module does not sufficiently protect certain routes and entity fields, allowing an access bypass. Drupal says the flaw may have financial impact on vendors running stores on the platform. A CVSS score has not been published.

Vulnerability Details

The advisory credits Dan Puccetti, Marcus Johansson and Robert Snyder for reporting the issue. Drupal has not described the nature or scale of the observed attacks.

Remediation

Update Commerce Core immediately:

# Drupal 10/11 with Composer
composer update drupal/commerce --with-all-dependencies
drush updatedb -y && drush cache:rebuild
 
# Verify installed version
composer show drupal/commerce | grep versions

The advisory lists no workarounds, so patching is the only mitigation.

Detection and Response

Because exploitation is confirmed, review stores for signs of tampering before and after patching:

1. Audit recent orders, order items, price/adjustment changes and payment records for unexpected edits.
2. Review web server logs for unusual requests to commerce routes from unauthenticated or low-privilege sessions.
3. Check for new or modified user accounts and role assignments.
4. Rotate admin credentials and payment gateway API keys if tampering is suspected.

Key Takeaways

1. Active exploitation is confirmed for CVE-2026-118539 in Drupal Commerce Core.
2. Fixed in 3.3.13 and 8.x-2.41; no workaround exists.
3. Store operators should patch now and audit order and pricing data for manipulation.

Sources

• The Hacker News
• BleepingComputer