CVE-2026-118539

Think of this like a store that locks the manager's office door, but leaves a side hallway unlocked that leads to the same room — if someone knows the hallway exists, they can walk in without a key. In this case, certain pages or data in the online store module weren't properly checked for permission before being shown, so someone could potentially reach them just by typing in the right web address.

This matters to you if your website runs on Drupal and uses the Commerce Core module to power an online store. It affects versions up to 2.41 on the 2.x branch and up to 3.3.13 on the 3.x branch — if you're already on a newer version, you're not affected.

There are no reports of attackers exploiting this, no public attack tools available, and it isn't on any government list of actively abused flaws, so this is a low-pressure fix. You should still apply the update during your normal maintenance routine, but there's no need for emergency action.

Confirm exposure by checking the installed Commerce Core module version via the Drupal admin UI (Reports > Available updates) or composer show drupal/commerce. Target fixed version 2.41 for sites on the 2.x branch, or 3.3.13 for sites on the 3.x branch — pick the branch matching your current major version to avoid unnecessary breaking changes. Review the Commerce module's release notes for the 2.41/3.3.13 releases for any migration or config changes before upgrading. There is no documented temporary workaround beyond restricting direct access to affected routes via server-level rules if upgrading must be delayed. No CISA KEV due date applies since this is not listed in KEV. Monitor the Drupal Security Advisory (SA-CONTRIB-2026-254) page and your site's access logs for unusual direct-URL access patterns to Commerce-related paths until patched.

Weakness: CWE-862 (Missing Authorization), enabling forceful browsing to resources that should require access control checks. Exploitation status: no PoC exploit code published, not listed in CISA KEV, no confirmed in-the-wild activity. Exploit maturity is low. Attack vector is unauthenticated/low-privilege HTTP requests to specific routes/resources lacking server-side authorization checks. EPSS prediction places this in the lower percentile range with a flat trend, consistent with the absence of confirmed exploitation. Press attention is newly emerging but reflects disclosure coverage, not active attacks.