Drupal warns Commerce Core access bypass is being exploited

Drupal is warning administrators that a critical access bypass flaw in the Commerce Core module is being exploited in the wild, according to a BleepingComputer report published October 30, 2026.

The flaw, tracked as CVE-2026-118539, comes from a missing authorization weakness that unauthenticated attackers can abuse. Drupal's advisory, tagged highly critical, says the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor."

The affected versions are Commerce Core 0.0.0 through 2.41 and 3.0.0 through 3.3.13. Drupal asked admins on the 3.x branch to upgrade immediately to 3.3.13, or to 8.x-2.41 for earlier versions, and to audit orders for inconsistencies.

Commerce Core is a community-developed module that adds a shopping cart, checkout and API support to Drupal sites. BleepingComputer reports it is used by more than 42,000 websites.

Why it matters

An access bypass in a storefront module is a business problem, not just a patching chore. If routes and entity fields aren't properly guarded, order and customer data can be reached without authorization, and the advisory itself points to possible financial impact for the vendor.

What defenders should do

• Identify whether Commerce Core is installed and which branch you run, then move to the fixed release Drupal names for that branch.
• Review recent orders for inconsistencies, as the advisory directs.
• Treat the module as internet-facing attack surface and check logs for unexpected access to commerce routes.

The report also notes that Drupal patched two remote code execution issues in core and a related module two weeks earlier, and that a separate core SQL injection flaw was added to CISA's Known Exploited Vulnerabilities catalog in May.

CVE references

CVE-2026-118539