{"id":"DRUPAL-CONTRIB-2026-254","details":"This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs.\n\nThe module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor.\n\nThis vulnerability is being actively exploited in the wild.","aliases":["CVE-2026-118539"],"modified":"2026-10-28T20:08:42Z","published":"2026-10-28T16:54:55Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-254"}],"affected":[{"package":{"name":"drupal/commerce","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/commerce?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.0"}],"database_specific":{"constraint":"\u003c2.41"}},{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.13"}],"database_specific":{"constraint":"\u003e=3.0.0 \u003c3.3.13"}}],"database_specific":{"source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce/DRUPAL-CONTRIB-2026-254.json","affected_versions":"\u003c2.41 || \u003e=3.0.0 \u003c3.3.13"}}],"schema_version":"1.9.2","credits":[{"name":"Dan Puccetti (dpuccetti)","contact":["https://www.drupal.org/u/dpuccetti"]},{"name":"Marcus Johansson (marcus_johansson)","contact":["https://www.drupal.org/u/marcus_johansson"]},{"name":"Robert Snyder (rsnyd)","contact":["https://www.drupal.org/u/rsnyd"]}]}