Drupal Commerce Core: critical authorization flaw under active exploitation
Attackers are already exploiting a flaw in Drupal Commerce Core (CVE-2026-118539), and they don't need to log in. It's fixed in 3.3.13 and 8.x-2.41. Shop owners should update and audit their orders.
Translated from the German original with an AI language model, approved by me. Read the original
On October 28, 2026, the Drupal Security Team published an advisory for Commerce Core, the module that adds shop features to Drupal sites. The flaw is tracked as CVE-2026-118539. Drupal rates it "highly critical" and says it is already being exploited in the wild.
What happened
According to advisory SA-CONTRIB-2026-254, the module "doesn't sufficiently protect certain routes and entity fields." Routes are the URLs where Drupal exposes functions. Entity fields are the data fields of objects such as orders or products. This is a missing authorization flaw: the system doesn't properly check whether someone is allowed to perform a given action. The result is an access bypass, meaning someone can get around access restrictions.
BleepingComputer reports that attackers can exploit the flaw without logging in. Drupal only says the bypass "may financially impact the vendor." It has not said how the attacks work or how widespread they are, as The Hacker News also notes.
There is no CVSS score yet. CVSS is the usual 0 to 10 scale for rating how severe a vulnerability is. Drupal uses its own rating system instead and gives this flaw 21 out of 25 points. That rating reflects that the flaw is easy to exploit, that an exploit exists (a tool for taking advantage of it), and that it affects all installations.
A correction on affected versions
My posts on X and WhatsApp said "affected: 0.0.0 to 2.41 and 3.0.0 to 3.3.13." The news coverage used the same wording. That wording is misleading. The advisory itself says "<2.41" and ">=3.0.0 <3.3.13". So every version before 2.41 and every 3.x version before 3.3.13 is affected. Those two versions contain the fix:
- 3.x branch: upgrade to Commerce Core 3.3.13
- Older installs: upgrade to Commerce Core 8.x-2.41
If you already run 3.3.13 or 8.x-2.41, you're protected against this flaw.
Who is affected
BleepingComputer says more than 42,000 websites use Commerce Core, including Fortune 500 companies and research universities. Any Drupal site with the module installed is affected, whether it's a large online store or a small club site that sells tickets. Drupal sites without Commerce are not affected by this flaw.
This isn't the only recent Drupal problem. In May 2026, attackers exploited an SQL injection in Drupal core (CVE-2026-9082), and the US agency CISA added it to its Known Exploited Vulnerabilities (KEV) catalog. About two weeks before this advisory, Drupal patched two remote code execution flaws. Those let attackers run their own code on the server from a distance.
What you should do now
- Check whether you use Commerce. You can see this in Drupal's module list or in your project's Composer dependencies.
- Compare the version. If it's below 3.3.13 (on the 3.x branch) or below 2.41 (on the older branch), you're affected.
- Update right away to 3.3.13 or 8.x-2.41. The flaw is already being exploited, so don't wait for your next maintenance window.
- Audit your orders. Drupal specifically advises checking orders for inconsistencies, such as unusual prices, discounts, statuses or payment details. Updating closes the hole, but it doesn't undo any tampering that has already happened.
- Ask your agency or host. If someone else runs your shop, ask them directly whether the update is installed.
I think step 4 matters most. When Drupal says a flaw can cost the vendor money, patching isn't enough on its own. You also need to check whether anyone has already changed anything.