CVE-2026-118539: Drupal Commerce Core access bypass is exploited, fixed in 3.3.13 and 2.41

Drupal has warned that a hole in Commerce Core, the e-commerce module behind tens of thousands of online shops, is already being used in attacks. The flaw is tracked as CVE-2026-118539 and published as advisory SA-CONTRIB-2026-254 on 28 October 2026. Drupal rates it "highly critical" (21 out of 25), and the fixes are Commerce Core 3.3.13 and 8.x-2.41. If you run a Drupal shop, updating the Commerce module (not just Drupal core) is the whole job, followed by a check of your orders and coupons.

Key points

• CVE-2026-118539 is an access bypass in Drupal Commerce Core, advisory SA-CONTRIB-2026-254, dated 28 October 2026 and rated "highly critical" (21/25) by the Drupal security team.
• Affected: Commerce Core versions below 2.41, and 3.0.0 up to but not including 3.3.13.
• Fixed in Commerce Core 3.3.13 (3.x branch) and 8.x-2.41 (older branch).
• Drupal says the flaw "is being actively exploited in the wild" but has published no details of the attacks.
• Drupal's advice is to upgrade and audit orders for inconsistencies; no configuration workaround is documented.

What to do

1. Check your version. Run composer show drupal/commerce or look at the Commerce module on the Extend page in the admin area. Anything on the 3.x line below 3.3.13, or on the 2.x line below 2.41, is affected.
2. Update the module. With Composer, on the 3.x line: composer require 'drupal/commerce:^3.3.13' --with-all-dependencies. On the older line, require ^2.41. Then run your database updates and clear caches (drush cr). Updating Drupal core alone does not fix this, because the bug is in the contributed Commerce module.
3. Reapply local patches. Ostorlab, a security firm that wrote up the flaw, notes that both branches changed, so custom patches may need to be redone.
4. Audit. Drupal tells site owners to look for order inconsistencies. Ostorlab suggests more specific checks: product variations whose owning product now belongs to a different account than the one that created them, coupons attached to a promotion other than the one that issued them, and writes to commerce entities from low-privilege accounts in your API logs.
5. Reduce exposure while you patch. Ostorlab says disabling JSON:API may shrink the attack surface, but that it does not replace the update.

What happened

Drupal's security team published SA-CONTRIB-2026-254 on 28 October 2026, the same day Commerce Core 3.3.13 and 8.x-2.41 were released, according to the Ostorlab write-up. The advisory is titled "Commerce Core - Highly critical - Access bypass". Its description says the module "doesn't sufficiently protect certain routes and entity fields", which leads to an access bypass "that may financially impact the vendor". The advisory's risk vector lists no required access complexity (AC:None) and marks the exploit as known (E:Exploit).

The advisory says the vulnerability "is being actively exploited in the wild". BleepingComputer, which reported the story on 30 October, says unauthenticated attackers can exploit it and that Commerce Core is used by more than 42,000 sites; that usage figure comes from BleepingComputer, not from the advisory, so treat it as an outlet's estimate. The Hacker News, also on 30 October, lists no CVSS score for the CVE and notes that Drupal gave no details on the activity or the scale of the campaign.

The advisory credits Dan Puccetti, Marcus Johansson and Robert Snyder with reporting the flaw. The advisory also credits a list of maintainers with the fix and with coordinating the release.

One small difference between sources: the advisory lists the affected range as versions below 2.41 and 3.0.0 up to but not including 3.3.13, while BleepingComputer and The Hacker News write "through 2.41" and "through 3.3.13". Because 2.41 and 3.3.13 are the fixed releases, the advisory's wording is the one to follow.

Background

Drupal Commerce is the main e-commerce framework for Drupal. It adds products, carts, orders, promotions and coupons as Drupal entities, and these entities can be read and written through Drupal's APIs, including JSON:API, which ships with Drupal core.

The flaw lands in a busy month for Drupal. BleepingComputer recalls that in May 2026 Drupal warned of an actively exploited SQL injection flaw, CVE-2026-9082, which CISA added to its Known Exploited Vulnerabilities (KEV) catalog with a three day deadline for federal agencies. Two weeks before this advisory, Drupal patched two remote code execution flaws, CVE-2026-108097 and CVE-2026-108099, and warned that exploits could appear "within hours or days". Those are separate issues from CVE-2026-118539.

The Drupal security team handles contributed modules such as Commerce through "SA-CONTRIB" advisories, which are separate from core advisories. Site owners who only watch for core releases can miss them, so a shop that only tracks core releases can miss them.

How it works

According to Ostorlab, Commerce had access control at the level of whole entities but not at the level of individual fields. Some fields link one commerce object to another: a variation to a product, a coupon to a promotion. Those cross-reference fields were not checked against who owns what.

In practice, Ostorlab describes these consequences:

• A limited-privilege account in a multi-vendor shop could point another vendor's product variation at a product it controls, effectively taking over a listing.
• Coupons could be moved between promotions through JSON:API or REST.
• Customers could change restricted fields on their own carts, such as the cart state and totals.

Ostorlab's conditions for exposure are an affected version, non-admin accounts that can write commerce entities (customers editing carts, or vendors with limited commerce permissions), and JSON:API or REST being available. Sites where only full administrators can write commerce data are not exposed to the vendor takeover paths, though customers with carts remain a risk.

The fix adds checks for restricted fields, limits coupon autocomplete to authorised users, adds ownership checks when promotions are deleted, and adds permission requirements to order administration routes. These details come from Ostorlab's reading of the change, not from the advisory, which keeps its description to one sentence.

Ostorlab also gives a short timeline: Commerce 2.40, the last 2.x release before the fix, came out on 22 August 2024; the fixes and the advisory followed on 28 October 2026; and the CVE record was published on 30 October without a CVSS score. Its write-up notes that CISA's KEV catalog did not list the flaw as of 29 October. We have not confirmed a KEV listing ourselves, so the exploitation claim rests on Drupal's own advisory.

What it means

For shop owners, the practical risk is financial, as Drupal's own wording suggests: tampered carts and totals, hijacked product listings, and stolen or misdirected coupons. A multi-vendor marketplace, where many accounts have limited write rights, is the setup Ostorlab identifies as most exposed. A single-merchant shop with only admin staff is less exposed, but customer carts still count.

For agencies and hosts, this is another case for keeping contributed modules inside an update routine: Composer, a staging check, and a rollback plan. Nothing here needs a new tool.

Because exploitation is reported but undescribed, patching is not the end: an attacker who had access before the update stays in your data. That is why Drupal asks for an audit after the upgrade, and why the checks above (ownership changes, coupon moves, odd API writes) matter.

What we don't know yet

• How many shops were attacked, and what the attackers did. Drupal has published no indicators, and the exploitation claim has not been independently measured.
• Whether the flaw will join the CISA KEV catalogue. Ostorlab reported it absent on 29 October.
• The CVSS score. The CVE record had none on 30 October.
• The real number of exposed sites. The 42,000 figure is BleepingComputer's, and install counts do not say how many sites run affected versions with non-admin write access.

What to watch next

Watch the SA-CONTRIB-2026-254 page for revisions, the CISA KEV catalogue for a listing, and your own logs for writes to commerce entities from limited accounts. If you manage many Drupal sites, also check that the two core remote code execution fixes from earlier in October are applied, since BleepingComputer links the two events in time, though not in cause.

Sources

• Drupal security team, SA-CONTRIB-2026-254: Commerce Core, highly critical, access bypass
• BleepingComputer: Drupal warns of critical Commerce Core flaw exploited in attacks
• The Hacker News: Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
• Ostorlab: Drupal Commerce Access Bypass, Exploited in the Wild (CVE-2026-118539)
• CISA Known Exploited Vulnerabilities catalogue