A Drupal Commerce flaw on 42,000 sites is under active attack
A missing-authorisation bug in the Commerce Core module, CVE-2026-118539, lets attackers reach routes and data they should never see, no account needed, and Drupal says it is already being exploited.
Drupal’s security team published SA-CONTRIB-2026-254 on 28 October for a missing-authorisation bug in Commerce Core, the contributed module that gives Drupal sites a shopping cart and checkout, tracked as CVE-2026-118539. The advisory rates it 21 out of 25 and states plainly that the flaw “is being actively exploited in the wild.”
The module doesn’t sufficiently protect certain routes and entity fields, so an attacker can request pages and data they were never meant to see, without an account. It affects 3.x before 3.3.13 and 8.x-2.x before 8.x-2.41; both fixes shipped the same day as the advisory. Commerce Core runs on more than 42,000 sites, according to Drupal’s own project usage statistics. Drupal is telling site owners to audit recent orders for inconsistencies, since the access bypass “may financially impact the vendor.”
Why it matters: this needs no login and no social engineering, just a request to the wrong route. If you run a Drupal storefront, update to 3.3.13 or 8.x-2.41 now, and check recent orders before you check anything else.
The caveat: Drupal hasn’t published how the exploitation was discovered or what attackers are doing with the access, so there’s no indicator-of-compromise list to check your logs against yet.