Summary
- CVE-2026-118539 affects vulnerable Drupal Commerce Core installations.
- Drupal's security team says the access bypass is being exploited in the wild.
- Fixed releases are 3.3.13 and 8.x-2.41, with administrators advised to examine order records.
The Drupal Security Team has confirmed active exploitation of a highly critical access-control flaw in Commerce Core, an extension used to provide shopping-cart, checkout, and transaction functions on Drupal-based websites. The weakness may allow unauthorised access to ecommerce resources protected by application permissions.
CVE-2026-118539 was described on 28 October in Drupal advisory SA-CONTRIB-2026-254. The project rated it 21 out of 25 on its risk scale and warned of possible financial consequences for merchants. Canada’s national cyber centre subsequently highlighted the issue in guidance dated 30 October.
The vulnerability stems from insufficient checking of access to certain routes and entity fields. These controls are intended to ensure that customers, merchant staff, administrators, and automated services can interact only with information and operations they are permitted to use.
A bypass at that layer can allow unauthorised interaction with transaction-related records or application functions. The precise impact depends on the operation that becomes reachable, the permissions assigned elsewhere in the installation, and the integrations connected with the affected module.
Drupal explicitly says the weakness is being exploited in the wild. Its published advisory does not, however, provide a verified number of compromised online stores, a total for financial losses, or a detailed public account of each attacker. Those consequences cannot be inferred merely from the high severity classification.
The earlier Commerce Core branch requires version 8.x-2.41, while installations on the 3.x line need version 3.3.13. The affected ranges extend below those releases. Administrators must check which branch and module version are installed before determining whether a site has received the necessary correction.
The security team also advised operators to review order records for inconsistencies. That recommendation addresses the possibility that data was modified before the fix was applied. A software update closes the vulnerable access route but cannot automatically establish whether previously recorded transactions remain accurate.
Ecommerce software serves several distinct user roles. Customers may view their own purchases, merchants change product and fulfilment information, administrators manage configuration, and external services may communicate with payment or shipping systems. Reliable access controls are needed at each point where these roles can retrieve or change records.
If an unauthorised operation affects an order, the consequence may extend beyond the webpage itself. Fulfilment systems, stock records, payment reconciliation, and customer communications can rely on the same transaction information, meaning an alteration could influence subsequent operational processes.
Investigating discrepancies requires care. Legitimate refunds, order amendments, failed payments, and manual corrections can also change transaction records. Operators comparing application history with independent payment or accounting records should establish the cause of any inconsistency before attributing it to exploitation.
Commerce Core is a contributed Drupal project with a release cycle and security advisories separate from the core content management platform. Knowing that Drupal Core is updated does not establish that every enabled module or custom extension has received its latest security correction.
Businesses maintaining several storefronts may also use different branches of the module across deployments. Their inventories need to record the version, enabled configuration, and integration dependencies for each site rather than treating all Drupal installations as identical.
The Commerce Core issue is separate from the Drupal Field UI vulnerability reported earlier in October. Those disclosures involve different components and attack paths; the new exploitation warning concerns commerce permissions and potentially affected orders, not the previously reported core-module code-execution route.
The Drupal project has provided the corrected releases and the advisory needed to identify exposure. The observed exploitation status warrants attention, while the total number of merchants affected and the confirmed financial impact remain unresolved in the public material.
The recommendation to examine order integrity remains relevant even after upgrading, because remediation and retrospective assessment address different phases of a possible incident.
