Drupal warns of actively exploited Commerce Core authorization bypass flaw

Summary

Drupal says threat actors are exploiting a missing-authorization flaw tracked as CVE-2026-118539 in its Commerce Core component. Drupal describes it as highly critical, and affected versions are listed as 0.0.0 to 2.41 and 3.0.0 to 3.3.13; the CVSS score is not yet available.

If you use Drupal

Update Drupal Commerce Core to a fixed release named in Drupal's security advisory

Review web server and shop logs for unauthorized access or unexpected administrative actions

Check whether your site runs an affected Commerce Core version before patching

Update Commerce Core to the fixed version named in Drupal's security advisory

Review Commerce Core access rules and user permissions for unexpected changes

Check web server and site logs for unauthorized access to restricted pages or data

What the sources say 112

Oct 29, 2026, 6:30 PM UTC · Mastodon: “Rapid Response: Critical Drupal RCE (CVE-2026-108097).” Source

Oct 30, 2026, 4:01 AM UTC · Mastodon: “Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection.” Source

Oct 30, 2026, 4:01 AM UTC · Mastodon: “Vulnerability in Drupal ECA Helper.” Source

Oct 30, 2026, 4:01 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing.” Source

Oct 30, 2026, 4:01 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS).” Source

Oct 30, 2026, 4:01 AM UTC · Mastodon: “Vulnerability in Drupal Orphans Media.” Source

Oct 30, 2026, 4:01 AM UTC · Mastodon: “Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass.” Source

Oct 30, 2026, 4:01 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing.” Source

Oct 30, 2026, 4:01 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing.” Source

Oct 30, 2026, 4:01 AM UTC · Mastodon: “Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection.” Source

Oct 30, 2026, 4:01 AM UTC · Mastodon: “Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass.” Source

Oct 30, 2026, 4:02 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing.” Source

Oct 30, 2026, 4:02 AM UTC · Mastodon: “Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection.” Source

Oct 30, 2026, 4:02 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS.” Source

Oct 30, 2026, 4:02 AM UTC · Mastodon: “Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing.” Source

Oct 30, 2026, 4:02 AM UTC · Mastodon: “Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing.” Source

Oct 30, 2026, 4:02 AM UTC · Mastodon: “Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing.” Source

Oct 30, 2026, 4:02 AM UTC · Mastodon: “Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing.” Source

Oct 30, 2026, 4:02 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS.” Source

Oct 30, 2026, 4:02 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing.” Source

Oct 30, 2026, 4:02 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS).” Source

Oct 30, 2026, 4:03 AM UTC · Mastodon: “Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing.” Source

Oct 30, 2026, 4:03 AM UTC · Mastodon: “Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery.” Source

Oct 30, 2026, 4:03 AM UTC · Mastodon: “Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing.” Source

Oct 30, 2026, 4:03 AM UTC · Mastodon: “Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation.” Source

Oct 30, 2026, 4:03 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing.” Source

Oct 30, 2026, 4:03 AM UTC · Mastodon: “Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery.” Source

Oct 30, 2026, 4:03 AM UTC · Mastodon: “Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection.” Source

Oct 30, 2026, 4:03 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS).” Source

Oct 30, 2026, 4:03 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).” Source

Oct 30, 2026, 4:04 AM UTC · Mastodon: “Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection.” Source

Oct 30, 2026, 4:04 AM UTC · Mastodon: “Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection.” Source

Oct 30, 2026, 4:04 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).” Source

Oct 30, 2026, 4:04 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point allows Stored XSS.” Source

Oct 30, 2026, 4:04 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole allows Stored XSS.” Source

Oct 30, 2026, 4:04 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS.” Source

Oct 30, 2026, 4:04 AM UTC · Mastodon: “Privilege Defined With Unsafe Actions vulnerability in Drupal Custom Formatters allows Privilege Escalation.” Source

Oct 30, 2026, 4:04 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field allows Stored XSS.” Source

Oct 30, 2026, 4:04 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing.” Source

Oct 30, 2026, 4:04 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper formatter allows Stored XSS.” Source

Oct 30, 2026, 4:05 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Distribution allows Stored XSS.” Source

Oct 30, 2026, 4:05 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons allows Cross-Site Scripting (XSS).” Source

Oct 30, 2026, 4:05 AM UTC · Mastodon: “Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing.” Source

Oct 30, 2026, 4:05 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attributes allows Stored XSS.” Source

Oct 30, 2026, 4:05 AM UTC · Mastodon: “Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing.” Source

Oct 30, 2026, 4:05 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Paragraph Components allows Stored XSS.” Source

Oct 30, 2026, 4:05 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing.” Source

Oct 30, 2026, 4:05 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Bootstrap allows Cross-Site Scripting (XSS).” Source

Oct 30, 2026, 4:05 AM UTC · Mastodon: “Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass.” Source

Oct 30, 2026, 4:05 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing.” Source

Oct 30, 2026, 4:06 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing.” Source

Oct 30, 2026, 4:06 AM UTC · Mastodon: “Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery.” Source

Oct 30, 2026, 4:06 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing.” Source

Oct 30, 2026, 4:06 AM UTC · Mastodon: “Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels.” Source

Oct 30, 2026, 4:06 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing.” Source

Oct 30, 2026, 4:06 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing.” Source

Oct 30, 2026, 4:06 AM UTC · Mastodon: “Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels.” Source

Oct 30, 2026, 4:06 AM UTC · Mastodon: “Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing.” Source

Oct 30, 2026, 4:06 AM UTC · Mastodon: “Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels.” Source

Oct 30, 2026, 4:06 AM UTC · Mastodon: “Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute Force.” Source

Oct 30, 2026, 4:07 AM UTC · Mastodon: “Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass.” Source

Oct 30, 2026, 7:02 AM UTC · Mastodon: “Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.” Source

Oct 30, 2026, 7:03 AM UTC · Mastodon: “Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels.” Source

Oct 30, 2026, 7:03 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS.” Source

Oct 30, 2026, 7:03 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS).” Source

Oct 30, 2026, 7:03 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing.” Source

Oct 30, 2026, 7:03 AM UTC · Mastodon: “Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing.” Source

Oct 30, 2026, 7:03 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing.” Source

Oct 30, 2026, 7:03 AM UTC · Mastodon: “Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery.” Source

Oct 30, 2026, 7:03 AM UTC · Mastodon: “Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass.” Source

Oct 30, 2026, 7:03 AM UTC · Mastodon: “Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync ( https:// content-sync.io ) allows Retrieve Embedded Sensitive Data.” Source

Oct 30, 2026, 7:04 AM UTC · Mastodon: “Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels.” Source

Oct 30, 2026, 7:04 AM UTC · Mastodon: “Vulnerability in Drupal GroupEx PRO ( Daxko ) integration.” Source

Oct 30, 2026, 7:04 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing.” Source

Oct 30, 2026, 7:04 AM UTC · Mastodon: “Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof.” Source

Oct 30, 2026, 7:04 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Site Scripting (XSS).” Source

Oct 30, 2026, 7:04 AM UTC · Mastodon: “External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal.” Source

Oct 30, 2026, 7:04 AM UTC · Mastodon: “Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection.” Source

Oct 30, 2026, 7:04 AM UTC · Mastodon: “Vulnerability in Drupal CacheFlush.” Source

Oct 30, 2026, 7:04 AM UTC · Mastodon: “Vulnerability in Drupal PayUmoney for Drupal Commerce.” Source

Oct 30, 2026, 7:04 AM UTC · Mastodon: “Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass.” Source

Oct 30, 2026, 7:05 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing.” Source

Oct 30, 2026, 7:05 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing.” Source

Oct 30, 2026, 7:05 AM UTC · Mastodon: “Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery.” Source

Oct 30, 2026, 7:05 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).” Source

Oct 30, 2026, 7:05 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.” Source

Oct 30, 2026, 7:05 AM UTC · Mastodon: “Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels.” Source

Oct 30, 2026, 7:05 AM UTC · Mastodon: “Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data.” Source

Oct 30, 2026, 7:06 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS.” Source

Oct 30, 2026, 7:06 AM UTC · Mastodon: “Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection.” Source

Oct 30, 2026, 7:06 AM UTC · Mastodon: “Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.” Source

Oct 30, 2026, 7:06 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing.” Source

Oct 30, 2026, 7:06 AM UTC · Mastodon: “Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery.” Source

Oct 30, 2026, 7:06 AM UTC · Mastodon: “Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing.” Source

Oct 30, 2026, 7:06 AM UTC · Mastodon: “Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS.” Source

Oct 30, 2026, 7:07 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing.” Source

Oct 30, 2026, 7:07 AM UTC · Mastodon: “Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing.” Source

Oct 30, 2026, 7:45 AM UTC · The Hacker News: “Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component.” Source

Oct 30, 2026, 10:16 AM UTC · BleepingComputer: “Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.” Source

Oct 30, 2026, 10:16 AM UTC · BleepingComputer on Bluesky: “Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.” Source

Oct 30, 2026, 11:07 AM UTC · SecurityWeek: “Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.” Source

Oct 30, 2026, 11:40 AM UTC · Mastodon: “Drupal Commerce Core Vulnerability Exploited Against Online Stores via SecurityWeek” Source

Oct 30, 2026, 1:24 PM UTC · Mastodon: “Threat actors are actively exploiting a critical access bypass vulnerability within the Drupal Commerce core, leading to unauthorized database access across multiple online retail platforms.” Source