CVE-2026-118542

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

CVE-2026-118543

Cross-Site Request Forgery CSRF vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

CVE-2026-118544

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

CVE-2026-118541

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

CVE-2026-118539

Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13...

CVE-2026-118540

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0...

CVE-2026-118539 Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254

Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13...

CVE-2026-118539

The Drupal Commerce Core module is vulnerable to a Missing Authorization (CWE-862) issue, which allows Forceful Browsing . The vulnerability stems from the module failing to sufficiently protect specific routes and entity fields , potentially leading to an access bypass that may result in financi...

EUVD-2026-113518

Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13...

CVE-2026-118540

Drupal Commerce Core is affected by an Incorrect Authorization vulnerability (CWE-863) that enables Forceful Browsing . When integrated with the JSON:API module , the flaw allows users to access unpublished product variations without proper permission. This issue specifically impacts Commerce Cor...

EUVD-2026-113517

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0...

CVE-2026-118541

The Drupal Commerce Core module is vulnerable to an Incorrect Authorization issue (CWE-863) that allows Forceful Browsing . The root cause is a failure to sufficiently check access permissions regarding the relationship between promotions and coupons. Specifically, a user authorized to manage the...

EUVD-2026-113516

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

CVE-2026-118542

Drupal Commerce Core versions 0.0.0 to 2.41.0 and 3.0.0 to 3.3.13 are affected by an Incorrect Authorization vulnerability. The module fails to properly validate access permissions when a store is saved. Consequently, a user with permissions to create or edit their own store can illicitly mark th...

EUVD-2026-113515

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

CVE-2026-118543

Drupal Commerce Core versions 0.0.0 to 2.41.0 and 3.0.0 to 3.3.13 are vulnerable to a Cross-Site Request Forgery (CSRF) . The root cause is that routes for the dashboard inbox do not perform CSRF token validation. An attacker can trick a user with "access commerce administration pages" permission...

EUVD-2026-113514

Cross-Site Request Forgery CSRF vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

CVE-2026-118544

Drupal Commerce Core versions 0.0.0 to 2.41.0 and 3.0.0 to 3.3.13 are vulnerable to an information disclosure flaw (CWE-202). The root cause is that the module fails to sufficiently restrict product variations returned by entity queries to only those the current user is authorized to view. When t...

EUVD-2026-113513

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

EUVD-2026-43115

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6...