MEDIUM CWE-862
CVE-2026-118539
Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254
Drupal·Commerce Core
6.5/ 10
CVSS 3.1
Medium severity
0.67%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 53% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Oct 30, 2026
- Updated
- Oct 31, 2026
- First covered
- Oct 30, 2026
- Latest story
- 2 weeks ago
Summary
Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.
CWE-862Missing Authorization
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityLow
IntegrityLow
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NAffected products
- Drupal Commerce Core0.0.0 to before 2.413.0.0 to before 3.3.13