Drupal Commerce Core access bypass CVE-2026-118539 rated highly critical, exploited in the wild

TLDR

• Drupal's SA-CONTRIB-2026-254 rates a Commerce Core access bypass highly critical and says it is being actively exploited.¹
• The fix is Commerce Core 3.3.13 or 8.x-2.41, and Drupal tells sites to audit orders for inconsistencies.¹
• Centarro says merchants saw fraudulent order attempts and it does not believe abuse was scripted beyond the first sites.²

The Drupal Security Team published advisory SA-CONTRIB-2026-254 for the Commerce Core module on 28 October 2026, rating it highly critical at 21 out of 25 and tracking it as CVE-2026-118539.¹ The advisory says the module "doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor", and that the vulnerability is being actively exploited in the wild.¹ It lists the affected versions as earlier than 2.41, and 3.0.0 up to but not including 3.3.13, and tells 3.x users to upgrade to Commerce Core 3.3.13 and users of earlier versions to upgrade to 8.x-2.41.¹ It adds that sites should audit their orders for inconsistencies.¹

Centarro, which maintains Drupal Commerce, published its own post on 29 October in consultation with the Drupal Security Team.² It says it received two reports of attempts by malicious users to place fraudulent orders using the flaw, made by merchants who saw suspicious activity on live sites.² Centarro and the Drupal Security Team looked for broader abuse and, as of that post, do not believe it was scripted or exploited beyond the initial sites.² Centarro says the issue affects both full-stack and headless sites, with attack vectors that differ by architecture.² Its audit guidance covers orders placed but not paid, orders that appear paid with no payment entities (mainly on sites that update Commerce data through the JSON:API module), suspicious product prices, and discounts or fees that staff did not add.² Reports included orders with obviously incorrect prices such as $0.01 and orders with normal prices.²

Centarro says exploits have been theoretically possible since Commerce Core 8.x-2.18, released on 26 May 2020, when used with JSON:API, and since 8.x-2.25, released on 30 June 2021, for all other sites.² It also packaged security releases for Commerce API, Commerce License, Commerce Shipping and Commerce Stripe, advises sites that do not need JSON:API update operations to switch it back to read-only, and says full payment should be confirmed before any goods or services are delivered.² BleepingComputer reports that the flaw is a missing authorisation weakness abusable by unauthenticated attackers, and that Commerce Core is used by more than 42,000 websites.³ The sources differ in places. BleepingComputer gives the affected range as 0.0.0 through 2.41 and 3.0.0 through 3.3.13, whereas Drupal's advisory lists versions earlier than 2.41 and 3.0.0 up to but not including 3.3.13, with 2.41 and 3.3.13 as the fixed releases.¹³ Drupal's advisory text does not use the word unauthenticated, though its rating string includes A:None, which Rescana reads as meaning no account is needed.¹⁴ Drupal states that the flaw is being actively exploited, while Centarro describes two reported cases of attempted fraudulent orders.¹²

Rescana, a vendor blog, reports that the CVE record classifies the flaw as CWE-862 (Missing Authorization), that neither the CVE record nor NVD carried a CVSS score when it checked on 30 October, and that the CVE was not in CISA's Known Exploited Vulnerabilities catalogue as of catalogue version 2026.10.29.⁴ It also reports that Drupal published same-day advisories for Commerce License, Commerce Shipping and Commerce Stripe, including SA-CONTRIB-2026-263, rated critical, which it says could let an attacker trick an administrator into a link that bypasses Stripe payment so an order is marked paid.⁴ Rescana adds that, of these Commerce advisories, Drupal reports active exploitation only for SA-CONTRIB-2026-254.⁴

Why it matters: a payment-handling flaw in a widely used e-commerce module is already being abused, so the sources urge patching now and checking recent orders for unpaid, oddly priced or manually adjusted ones.¹²³