Critical Drupal Commerce Core Access Bypass (CVE-2026-118539) Exploited in the Wild

Overview/Introduction

Drupal powers a sizable portion of the web, and its Commerce Core module is the de-facto solution for building online stores on the platform. On 28 October 2026 the Drupal security team disclosed a critical missing-authorization vulnerability, tracked as CVE-2026-118539, that permits an unauthenticated adversary to bypass all access checks on several key routes and entity fields. Within days, threat-intel feeds reported active exploitation, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the bug to its Known Exploited Vulnerabilities (KEV) catalog and issue a hard deadline for remediation.

Technical Details (CVE, Attack Vector, Exploitation Method)

The flaw resides in the routing and field-access logic of the Commerce Core module versions 0.0.0-2.41 (the 2.x branch) and 3.0.0-3.3.13 (the 3.x branch). Specifically, the module registers several internal routes-most notably the /checkout/{order_id} and /order/{order_id}/view endpoints-without invoking \Drupal::currentUser()->hasPermission() or the entity-level access control API. As a result, any HTTP request that supplies a valid order_id (which can be guessed or enumerated) receives the full order payload, including customer details, payment status, and internal notes.

Exploitation steps observed in the wild are straightforward:

1. Send an unauthenticated GET request to /order/12345/view (or the checkout variant) on a target site.
2. The Commerce Core router returns a JSON or HTML representation of the order, bypassing the usual access() check.
3. Harvest sensitive data (email addresses, shipping addresses, order totals) and, in some cases, manipulate the order state by issuing POST requests to the same endpoints, effectively marking an unpaid order as paid.

The vulnerability is classified with a Drupal risk score of 21/25, which roughly translates to a CVSS v3.1 base score of 9.8 (Critical). The high score reflects the unauthenticated remote exploitability and the potential for financial loss.

Impact Analysis (Who Is Affected, How Severe)

According to Drupal’s official usage statistics, the Commerce Core module is installed on more than 42,000 live sites worldwide, spanning small boutique shops to large enterprise storefronts. The affected versions cover both the legacy 2.x line (used by sites that have not migrated to the newer architecture) and the actively maintained 3.x line, meaning the vulnerability is not limited to legacy installations.

Impact categories include:

• Data Exposure: Unauthorized disclosure of personally identifiable information (PII) and payment-related data.
• Financial Fraud: Ability to mark orders as paid without completing a transaction, potentially triggering shipment of goods without revenue.
• Operational Disruption: Attackers can scrape entire order catalogs, overwhelming back-end systems and forcing administrators to suspend checkout functionality.
• Reputation Damage: Breaches of e-commerce sites are highly visible to customers and can erode brand trust.

Given the scale (tens of thousands of sites) and the unauthenticated nature of the exploit, the impact is considered critical under industry severity rubrics.

Timeline of Events

• Early October 2026: Initial discovery of the missing-authorization flaw by an internal Drupal security researcher.
• 14 Oct 2026: Drupal releases a security advisory covering 38 separate issues, but CVE-2026-118539 is not yet public.
• 28 Oct 2026: Drupal publishes the official advisory for CVE-2026-118539, providing patched versions (2.41 and 3.3.13) and urging immediate updates.
• 30 Oct 2026: SecurityWeek reports that the vulnerability is being actively exploited in the wild.
• 02 Nov 2026: CISA adds CVE-2026-118539 to the KEV catalog, assigning a mandatory remediation deadline of 30 Nov 2026 for federal agencies.
• 03 Nov 2026 (today): Multiple threat-intel feeds observe scan activity targeting the /order/*/view endpoint, confirming that exploitation is ongoing.

Mitigation/Recommendations

Administrators should take the following actions immediately:

1. Apply the official patches: Update Commerce Core to 8.x-2.41 or later for the 2.x branch, and to 8.x-3.3.13 or later for the 3.x branch. Use Composer or the Drupal UI to ensure all dependent modules are also refreshed.
2. Audit order data: Review recent orders for anomalies such as "paid" status without corresponding payment gateway logs. Flag and revert any suspicious transactions.
3. Restrict route access: As a temporary mitigation, add custom access callbacks in hook_route_alter() to enforce access_check on the vulnerable routes until the patch is applied.
4. Implement WAF rules: Block or rate-limit requests to /order/*/view and /checkout/* from unauthenticated IPs. Many Web Application Firewalls (e.g., ModSecurity, Cloudflare) provide rule-sets for this pattern.
5. Enable logging and monitoring: Increase log verbosity for Commerce Core routes and set up alerts for spikes in 200-OK responses to /order/*/view from non-authenticated sessions.
6. Review third-party integrations: Ensure that any custom code or contributed modules that interact with Commerce Core entities also perform proper permission checks.

For organizations subject to CISA directives, compliance with the 30 Nov 2026 deadline is mandatory; failure to patch may result in loss of federal funding or contractual penalties.

Real-World Impact (How This Affects Organizations/Individuals)

Online retailers that run on Drupal Commerce now face a two-fold risk: data leakage and revenue loss. A single successful request can expose a full order record, including the buyer’s name, address, email, and purchased items. Attackers can aggregate this data for credential stuffing, phishing, or resale on underground markets.

More damaging is the ability to manipulate order state. By issuing a crafted POST to the checkout endpoint, threat actors can flag an order as "paid" without completing a transaction, forcing merchants to ship goods for free. In high-volume stores, even a handful of such fraudulent orders can translate into thousands of dollars in loss.

Beyond direct financial harm, the public nature of e-commerce breaches can trigger regulatory consequences. In jurisdictions governed by GDPR, CCPA, or similar privacy statutes, exposure of customer PII without a breach notification may lead to hefty fines.

Expert Opinion

From a strategic perspective, CVE-2026-118539 underscores a recurring theme in the Drupal ecosystem: contributed modules often lag behind core in security rigor. While Drupal core receives intensive scrutiny, the vast library of add-ons-especially those handling sensitive workflows like commerce-can harbor simple yet devastating authorization oversights.

The rapid transition from disclosure to active exploitation suggests that threat actors have been monitoring Drupal’s release cadence and prepared exploit code in advance. This mirrors the pattern seen with previous high-impact Drupal flaws (e.g., the 2022 “Drupalgeddon” series), where the open-source nature of the platform accelerates both defensive and offensive development.

For the broader industry, the incident is a reminder that “critical” labels from vendors should be taken seriously only when corroborated by independent evidence-something CISA’s KEV listing now provides. Organizations that rely on Drupal Commerce must adopt a “patch-first” mindset, integrate automated dependency scanning into CI/CD pipelines, and treat contributed modules as a first-class attack surface.

Finally, the market impact may extend beyond Drupal. Many e-commerce platforms share similar architectural patterns (route registration without granular permission checks). Security teams should audit their own frameworks for analogous gaps, especially where order-processing APIs are exposed to the public internet.