CVE-2026-118539

The Drupal Commerce Core module is vulnerable to a Missing Authorization (CWE-862) issue, which allows Forceful Browsing . The vulnerability stems from the module failing to sufficiently protect specific routes and entity fields , potentially leading to an access bypass that may result in financi...

EUVD-2026-113518

Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13...

CVE-2026-118540

Drupal Commerce Core is affected by an Incorrect Authorization vulnerability (CWE-863) that enables Forceful Browsing . When integrated with the JSON:API module , the flaw allows users to access unpublished product variations without proper permission. This issue specifically impacts Commerce Cor...

CVE-2026-118540

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0...

EUVD-2026-113517

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0...

CVE-2026-118541

The Drupal Commerce Core module is vulnerable to an Incorrect Authorization issue (CWE-863) that allows Forceful Browsing . The root cause is a failure to sufficiently check access permissions regarding the relationship between promotions and coupons. Specifically, a user authorized to manage the...

EUVD-2026-113516

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

EUVD-2026-113515

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

CVE-2026-118542

Drupal Commerce Core versions 0.0.0 to 2.41.0 and 3.0.0 to 3.3.13 are affected by an Incorrect Authorization vulnerability. The module fails to properly validate access permissions when a store is saved. Consequently, a user with permissions to create or edit their own store can illicitly mark th...

CVE-2026-118543

Drupal Commerce Core versions 0.0.0 to 2.41.0 and 3.0.0 to 3.3.13 are vulnerable to a Cross-Site Request Forgery (CSRF) . The root cause is that routes for the dashboard inbox do not perform CSRF token validation. An attacker can trick a user with "access commerce administration pages" permission...

CVE-2026-118543

Cross-Site Request Forgery CSRF vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

EUVD-2026-113514

Cross-Site Request Forgery CSRF vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

CVE-2026-118544

Drupal Commerce Core versions 0.0.0 to 2.41.0 and 3.0.0 to 3.3.13 are vulnerable to an information disclosure flaw (CWE-202). The root cause is that the module fails to sufficiently restrict product variations returned by entity queries to only those the current user is authorized to view. When t...

EUVD-2026-113513

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

CVE-2026-118555

The Drupal Commerce License module (versions 0.0.0 to 3.1.1 ) contains an Incorrect Authorization vulnerability (CWE-863) that allows for Forceful Browsing . The root cause is insufficient restriction of access to license fields for users possessing the update own commerce_license permission. A l...

EUVD-2026-113512

Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1...

CVE-2026-118556

The Drupal Commerce Shipping module is affected by an incorrect authorization vulnerability (CWE-863) in versions 0.0.0 to 2.16.0 and 3.0.0 to 3.0.6 . The module fails to sufficiently protect shipment references and shipment entity fields, leading to an access bypass that may allow an attacker to...

CVE-2026-118556

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6...

EUVD-2026-113511

Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6...

CVE-2026-118557

The Drupal Commerce Shipping module is vulnerable to an Incorrect Authorization issue, specifically allowing Forceful Browsing . The root cause is that the module fails to sufficiently check access permissions on the form used to resend receipts. Depending on the configuration, this allows unauth...