CVE-2026-73475

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3...

CVE-2026-73475

CVE-2026-73475 is an Incorrect Authorization vulnerability in the Drupal Commerce PayPal module that allows Forceful Browsing . The module fails to sufficiently validate the transaction result when using the Payflow Link payment gateway, enabling a malicious user to mark transactions as completed...

CVE-2026-73475 Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3...

EUVD-2026-69993

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3...

DRUPAL-CONTRIB-2026-095

This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...

Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...