CVE-2026-96378

The Drupal Commerce Decoupled Checkout module (versions 1.0.0 to 1.8.0 ) is vulnerable to Object Injection due to an Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915). The root cause is insufficient sanitization of order data passed into the module's REST en...