Drupal Commerce Core Access-Control Flaw Exposes Ecommerce Sites

Key points

• CVE-2026-118539 affects the Drupal Commerce Core module.
• The defect is an access-control bypass tied to checks that are not enforced.
• Threat actors could use it to reach store functions without proper permission.
• Ecommerce teams should inventory exposure and watch for a vendor fix.

An access-control defect has been identified in Drupal’s Commerce Core component and assigned CVE-2026-118539. The problem is not a memory-safety bug; it is an authorization failure in which certain operations lack the permission checks they should enforce. That means an attacker may be able to invoke functionality that ought to be restricted, depending on how a given site is configured and exposed.

Organizations most directly affected are those running Drupal-based ecommerce sites with Commerce Core enabled. Storefronts often expose carts, checkout flows, order management, and customer account features, so a control gap in this layer can have business consequences beyond a simple page defacement. Shops that have not reviewed module exposure should treat the CVE as a prompt to confirm whether they are in scope.

An authorization bypass in a commerce stack matters because store logic often assumes that platform permissions are reliable. If that assumption fails, unauthorized actions may become possible without the attacker needing valid elevated credentials. Even when public severity ratings are informational, ecommerce operators should not dismiss access-control issues; the impact depends heavily on local configuration, custom modules, and what the affected code paths can reach.

Watch for guidance from Drupal and Commerce Core maintainers, including updated releases and configuration notes. In the meantime, review logs for unusual order, checkout, account, or administrative activity, and verify that roles and permissions follow least privilege. Teams should also track whether their specific storefront uses the vulnerable component and document compensating controls until a fix is applied.

What to do now

1. Inventory every Drupal site that runs Commerce Core and mark which storefronts are internet-facing.
2. Apply the maintainer update for CVE-2026-118539 as soon as it is available; if no fix exists yet, limit public exposure and tighten access.
3. Audit Commerce roles, permissions, and custom code paths for operations that should require authorization.
4. Review web, application, and commerce logs for unexpected order, checkout, account, or admin actions.
5. Enforce least privilege for administrative accounts and remove unused integrations or service credentials.
6. After patching, retest storefront workflows to confirm permission checks behave as expected.

CVE references

• CVE-2026-118539

Original source

Security Affairs