Drupal Confirms Active Exploitation of Commerce Core Access-Control Flaw

Dev Community2 Nov 2026, 08:27 PKTvia NewsData.io

Drupal has confirmed active exploitation of an access-control vulnerability in Commerce Core. Tracked as CVE-2026-118539, the flaw affects versions before 2.41 and versions from 3.0.0 to before 3.3.13. Organizations using affected releases for online stores or transaction management systems should assess their exposure. Technical facts and known limits Some Commerce Core routes and entity fields lack sufficient access protection, creating a possibility of bypassing access controls. Drupal considers the issue very serious, but the source provides no CVSS score. An access-control bypass could ha

Read the full story on Dev Community

Headline and summary provided via NewsData.io. The full article and its copyright belong to the original publisher.

Drupal Confirms Active Exploitation of Commerce Core Access-Control Flaw

Drupal Confirms Active Exploitation of Commerce Core Access-Control Flaw

Six predicates in this codebase are written twice, once in TypeScript and once in SQL

Designing photo-to-video workflows around roles, scenes and honest previews

WhatsApp Coexistence for Developers: History Sync, Message Echoes and Contacts Without Breaking Your Inbox