The Drupal security team has issued an urgent advisory warning administrators of active, in-the-wild exploitation targeting a critical vulnerability in the Commerce Core module. The flaw enables unauthenticated threat actors to bypass security controls on e-commerce websites and manipulate transactions, potentially causing direct financial losses to merchants.
Tracked as CVE-2026-118539, the issue has been designated as highly critical by the project maintainers. Drupal advised site owners running affected versions to install security updates immediately and conduct forensic audits on recent order histories to check for unauthorized activity.
Missing Authorization in Commerce Core
Commerce Core is an open-source framework used by Drupal websites to manage product catalogs, handle shopping carts, process checkout forms, and expose e-commerce application programming interfaces (APIs) to decoupled applications. According to project statistics cited by BleepingComputer, the module is deployed across more than 42,000 sites, including deployments for research universities and Fortune 500 enterprises.
The vulnerability stems from missing authorization checks within the module's routing and entity handling mechanisms. Specifically, Commerce Core fails to adequately restrict access to particular routes and entity fields. Because these endpoints lack sufficient protection, an unauthenticated remote attacker can exploit the deficiency regardless of the site's specific configuration.
As detailed in reporting by SecurityWeek, the Drupal security team assigned the vulnerability a risk rating of 21 out of 25. The flaw was discovered and reported to the project by security researchers Dan Puccetti, Marcus Johansson, and Robert Snyder, according to The Hacker News.
Active Exploitation and Impact
In its security advisory, Drupal confirmed that malicious actors are already leveraging CVE-2026-118539 in live attacks. The advisory noted that the access bypass “may financially impact the vendor,” warning that unauthorized requests can interfere with critical commerce logic.
Drupal has not disclosed technical specifics regarding the exact exploitation methodology, nor has it publicly identified the threat actors responsible or the total number of compromised storefronts. It remains unconfirmed whether attackers discovered and leveraged the flaw as a zero-day prior to the publication of the official patch.
The alert was issued alongside a broader collection of 38 security advisories published on October 28, which addressed vulnerabilities across 21 contributed modules. Those releases resolved several other high-severity issues, including a bug that could allow orders processed through Stripe to be marked as completed without actual payment, as well as a CAPTCHA bypass issue.
Affected Versions
The authorization bypass vulnerability affects the following releases of the Drupal Commerce Core module:
- Commerce Core versions 3.0.0 through 3.3.12 (all 3.x releases prior to 3.3.13)
- Commerce Core legacy versions 0.0.0 through 2.41 (all releases prior to 8.x-2.41)
The maintainers have addressed the flaw in Commerce Core versions 3.3.13 and 8.x-2.41.
What You Should Do
IT administrators, web developers, and security teams managing Drupal-powered e-commerce environments should treat CVE-2026-118539 as an urgent remediation priority. Defenders are advised to take the following steps:
- Apply security updates: Upgrade installations on the 3.x release line to Commerce Core 3.3.13. Deployments on earlier branches must be upgraded to Commerce Core 8.x-2.41.
- Audit order databases: Review transaction logs, order records, and checkout entries for anomalies, such as price discrepancies, unexpected entity field modifications, or orders completed without verified payment gateways.
- Review API access logs: Inspect web server access logs for anomalous requests to Commerce Core routing endpoints, particularly requests originating from unauthorized or unexpected remote IP addresses.
- Monitor contributed module advisories: Review the remaining security updates released in the October 28 Drupal advisory batch to ensure all third-party integrations, including payment handlers and form-protection modules, are patched.
