Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-118539

Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing

Risk score
42/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.2%
Published
30 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
Affected
See advisory
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
Exploitation reported in the press

Story map

Story map: CVE-2026-118539THE FLAWSTHE FIXCVE-2026-118539Missing Authorizationvulnerability in DrupalCommerce Core allows…CVSS 6.5 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedSee advisoryYELLOW · PLAN IT INCVE-2026-118539Missing Authorizationvulnerability in Drupal CommerceCore allows Forceful Browsing.This issue affects CommerceCore versions: from 0.0.0 to2.41, from 3.0.0 to 3.3.13.Where it standsExploitation reported in the press3 outlets covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.30 Oct · The Hacker NewsHackers Actively Exploit Highly Critical DrupalCommerce Core Authorization Bypass Flaw30 Oct · BleepingComputerDrupal warns of critical Commerce Core flawexploited in attacks30 Oct · SecurityWeekDrupal Commerce Core Vulnerability ExploitedAgainst Online StoresCONNECTS TOSame weaknessMissing authorisation (CWE-862)399 other warnings in 30 days →Reported alongsideUse of Externally-ControlledInput to Select Classes or Code…CVE-2026-108099 · in 2 of the samearticles →Reported alongsideUse of Externally-ControlledInput to Select Classes or Code…CVE-2026-108097 · in 2 of the samearticles →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

CVE-2026-118539: Yellow, plan it in. Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

The flaws

  • CVE-2026-118539: Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing (CVSS 6.5 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: See advisory

Where it stands

  • Exploitation reported in the press
  • 3 outlets covering it

How it unfolded

  1. 30 Oct, The Hacker News (press): Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
  2. 30 Oct, BleepingComputer (press): Drupal warns of critical Commerce Core flaw exploited in attacks
  3. 30 Oct, SecurityWeek (press): Drupal Commerce Core Vulnerability Exploited Against Online Stores

Connects to

In the news

TL;DR

Drupal Commerce Core vulnerability allows forceful browsing, exploited in the wild, affects 42,000 sites.

  • Drupal urges online store owners to patch a highly critical access bypass vulnerability.
  • The vulnerability affects Commerce Core versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13.
  • Administrators should update to one of the two fixed versions and review their store orders.

AI summary of 3 articles.

Why it is Yellow

  • CVSS 6.5 medium

References

Original description

Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

Last activity 30 Oct 2026. Patch Forecast updates every hour.