Attackers actively exploit Drupal Commerce Core authorization bypass that can financially impact online vendors

Drupal disclosed CVE-2026-118539, a highly critical missing-authorization flaw in Drupal Commerce Core that it says is actively exploited in the wild. The advisory states the module does not sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor, though Drupal gave no detail on the attacks. It affects Commerce Core versions up to 2.41 and from 3.0.0 through 3.3.13, with fixes in Commerce Core 3.3.13 for the 3.x line and 8.x-2.41 for earlier versions. Store operators should update immediately and review orders and permissions for signs of abuse.

Check

Update Drupal Commerce Core to 3.3.13 or 8.x-2.41 immediately, then review orders, pricing, and permissions for signs of the access-bypass abuse.

Affected

Drupal Commerce Core up to 2.41 and 3.0.0 through 3.3.13 lets attackers bypass access controls on certain routes and fields, with financial impact on vendors.

Fix

Apply the fixed Commerce Core release, audit transactions and entity permissions, and monitor store logs given confirmed in-the-wild exploitation.