Drupal Commerce Core CVE-2026-118539 Authorization Flaw Exploited

Drupal has issued an urgent warning stating that malicious actors are actively exploiting a highly critical security flaw affecting its widely used Commerce Core component.

• The vulnerability is tracked as CVE-2026-118539 and involves missing authorization issues.
• Affected versions include Commerce Core 0.0.0 to 2.41 and 3.0.0 to 3.3.13.
• The module provides foundational shopping cart and e-commerce capabilities for Drupal sites.

Understanding the Authorization Flaw

The security defect stems from missing authorization checks, which can potentially allow unauthorized attackers to bypass security controls and interact with sensitive store functionalities.

Because Commerce Core handles essential e-commerce operations such as product sales and customer carts, vulnerabilities of this severity pose significant risks to online stores and their transactional data integrity.

Mitigation and Recommended Actions

Site administrators and developers running vulnerable versions of Drupal Commerce Core are urged to apply available security updates and patches immediately.

Prompt remediation is essential to mitigate ongoing exploitation attempts and safeguard e-commerce platforms against unauthorized access and potential data breaches.