Drupal Commerce Core CVE-2026-118539: Exploited Bypass

What to do

1. Check the installed version with composer show drupal/commerce.
2. Upgrade: composer require 'drupal/commerce:^3.3.13' (or 'drupal/commerce:^2.41' on 8.x-2.x), then drush updb and drush cr.
3. Audit orders placed or changed since at least early October for inconsistencies: totals, prices, adjustments, payment state and ownership.
4. Reconcile paid orders against your payment gateway's records before fulfilling pending ones.
5. Watch SA-CONTRIB-2026-254 for added detail on the affected routes and fields.

How to check if you are affected or compromised

• Compare each order's total and payment state in Drupal with the transaction recorded at your payment gateway; mismatches are the main signal.
• Look for order items or adjustments changed after checkout completed, and for orders owned by a different customer than the one who paid.
• Review web logs for anonymous or unusual requests to cart, checkout, order and Commerce API routes, especially non-GET methods.
• Review Drupal's recent log messages (drush watchdog:show) for unexpected order or payment activity.

What happened#

On October 28, 2026, the Drupal Security Team published SA-CONTRIB-2026-254 for Commerce Core, the main e-commerce module for Drupal. It rates the issue Highly critical (21 of 25, risk string AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All) and describes an access bypass: the module "doesn't sufficiently protect certain routes and entity fields," which can "financially impact the vendor." The advisory says the flaw "is being actively exploited in the wild" and tells sites to "audit their orders for inconsistencies."

CVE-2026-118539, published October 30 by Drupal's CNA, classes it as a missing-authorization flaw that allows forceful browsing, meaning direct requests to routes or fields that should have been off limits. The CVE record carries no CVSS score. BleepingComputer reports that unauthenticated attackers can exploit it. Which routes and fields are affected, and what attackers have done with them, is not disclosed as of October 31, 2026.

Who is affected#

Sites running Commerce Core 3.x before 3.3.13, or 8.x-2.x before 8.x-2.41. Both fixed releases shipped on October 28. The project page says 42,002 sites report using the module. The real number is likely somewhat higher, since not every site reports usage. Commerce Core is maintained by Centarro. Drupal core is not part of this advisory, and sites without the Commerce module are not affected.

The advisory's module description covers both classic storefronts and decoupled stores that expose Commerce through APIs. Until the affected routes are published, treat both as in scope.

Do you really need to act?#

Yes, if you run Commerce. This is not a theoretical bug. The maintainers confirm exploitation, the risk string records a known exploit, and BleepingComputer says no login is needed. "Financially impact the vendor" and "audit their orders" point to tampering with orders, prices or payment state rather than data theft. That kind of damage turns into lost goods and chargebacks, and nobody notices until fulfillment or reconciliation.

The upgrade is a module update within the same major line, so for most sites it is a routine Composer change. The audit is the slower part, and it is the step teams tend to skip.

What to do now#

1. Check your version: composer show drupal/commerce, or drush pm:list --filter=commerce.
2. Upgrade. On 3.x: composer require 'drupal/commerce:^3.3.13' -W. On 8.x-2.x: composer require 'drupal/commerce:^2.41' -W. Then run drush updb -y and drush cr, and deploy.
3. Hold fulfillment of recent unshipped orders until each one's total and payment state matches what your payment gateway recorded.
4. Audit orders placed or modified since early October. The advisory gives no start date for exploitation, so go back as far as you reasonably can.
5. If you can't upgrade today, consider putting the store in maintenance mode or restricting checkout and API routes at the edge until you can. The exact vulnerable routes have not been published.

How to tell if you were hit#

Drupal's only published indicator is order inconsistencies, so start there. Reconcile Drupal orders against gateway transactions and look for paid states without a matching charge, totals below the sum of item prices, unexpected adjustments or promotions, order items edited after checkout, and orders moved between customers. Then check web server logs for anonymous requests to /cart, /checkout, order routes and any JSON:API or Commerce API endpoints, especially PATCH or POST requests from clients that never browsed the store. Also review drush watchdog:show for unexpected order state transitions. Keep evidence before you correct any orders.

Timeline#

• Oct 28, 2026 — Drupal publishes SA-CONTRIB-2026-254, Commerce Core 3.3.13 and 8.x-2.41 are released, and active exploitation is noted in the advisory.
• Oct 30, 2026 — CVE-2026-118539 is published. BleepingComputer reports the exploitation warning.
• Oct 31, 2026 — Affected routes and attack details still not disclosed. No CVSS score and no KEV listing.

Vulnerability records

• CVE-2026-118539 · Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Drupal Security Team — SA-CONTRIB-2026-254: Commerce Core, Highly critical, Access bypass drupal.org
2. CVE.org — CVE-2026-118539 cve.org
3. Drupal.org — Commerce Core project page drupal.org

Coverage and analysis

1. BleepingComputer — Drupal warns of critical Commerce Core flaw exploited in attacks bleepingcomputer.com