Vulnerabilities · Application Security
Drupal Commerce Core flaw lets attackers bypass authorisation checks
Hackers are actively exploiting a critical flaw in Drupal Commerce Core that lets them bypass authorisation checks. Site owners are urged to update to the latest version to protect their online stores.
Ross Grant2 min read
The short version
A serious security flaw has been found in Drupal Commerce Core, a tool used by many online shops. Attackers can use this flaw to get into parts of a website they should not be able to access. If you run a Drupal site with this module, you need to update it right away. This helps keep your shop and your customers safe.
What happened?
Hackers are actively exploiting a critical authorisation bypass flaw in Drupal Commerce Core, tracked as CVE-2026-118539. The flaw affects versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13, letting attackers access protected parts of e-commerce sites. Drupal has released updates to fix the issue and urges site owners to upgrade immediately.
How the flaw works
A critical security flaw, tracked as CVE-2026-118539, has been found in Drupal Commerce Core, a module that lets websites sell goods and services through shopping carts, checkout forms, and APIs. The flaw is due to missing authorisation checks. This means certain parts of the site and data fields are not properly protected, allowing attackers to access them without the right permissions. Both The Hacker News (opens in a new tab) and Security Affairs (opens in a new tab) report that this vulnerability is being actively exploited, but there are no details yet on the scale or specific incidents.
The affected versions are Commerce Core 0.0.0 to 2.41 and 3.0.0 to 3.3.13. The flaw lets attackers use a method called "forceful browsing" to access routes and fields they should not be able to reach. This could let them view or change information, or perform actions that could cost the site owner money.
Who is affected
Any website running the affected versions of Drupal Commerce Core is at risk. This includes online stores and businesses using the module to handle sales through their website or APIs. The module is popular with e-commerce sites built on Drupal, an open-source content management system.
The response
Drupal has credited researchers Dan Puccetti, Marcus Johansson, and Robert Snyder for reporting the flaw. The project maintainers have confirmed the vulnerability is being actively exploited. They have released updates to fix the issue. Users of the 3.x branch should upgrade to version 3.3.13, while those on earlier releases should move to Commerce Core 8.x-2.41. Site owners are strongly advised to update as soon as possible to protect their stores from attack.
What you should do
If you run a Drupal site with Commerce Core, check your module version. If it falls within the affected ranges, update immediately to the fixed version. Even if you have not seen signs of compromise, updating is the only way to close this security gap. Regularly check for security advisories from Drupal and keep all modules up to date to reduce risk.
Has this happened before?
In May, Drupal warned of another serious flaw (CVE-2026-9082) in its database abstraction API. That vulnerability allowed attackers to gain higher privileges and execute malicious code. The US Cybersecurity and Infrastructure Security Agency (CISA) added that flaw to its Known Exploited Vulnerabilities (KEV) Catalogue, showing that Drupal modules have been targeted before.
Why it matters
This flaw puts online shops and their customers at risk of unauthorised access or financial loss. Site owners who do not update could see attackers bypass protections and access sensitive data or functions. Quick action is needed to prevent harm.
Key points
- Critical flaw in Drupal Commerce Core lets attackers bypass authorisation.
- All versions from 0.0.0 to 2.41 and 3.0.0 to 3.3.13 are affected.
- Drupal has released updates to fix the issue.
- Attackers are already exploiting the flaw in the wild.
- Site owners must update immediately to protect their stores.
Sources
The Hacker News
Reference
Security Affairs
Reference
