Drupal Commerce access bypass is exploited; update to 3.3.13

Drupal Commerce access bypass is exploited; update to 3.3.13

28 October 2026: The Drupal Security Team has rated an access bypass in Commerce Core, the module most Drupal shops are built on, highly critical and says it "is being actively exploited in the wild". CVE-2026-118539 affects every release before 8.x-2.41 and 3.x releases before 3.3.13, needs no account to exploit, and lets an attacker reach routes and entity fields that should be protected, in a way the advisory says "may financially impact the vendor". The fix is Commerce Core 3.3.13 for the 3.x line and 8.x-2.41 for older sites.

Not yet independently verified. Drupal's advisory names neither the routes and fields involved nor any CVSS score, and no one has yet said how many shops were hit; the exploitation statement rests on the advisory alone. We will update this when it can be confirmed, and remove this note.

A score of 21 out of 25

Drupal scores contributed-module flaws on its own 25-point scale rather than CVSS. SA-CONTRIB-2026-254, published on 28 October, reaches 21: no access complexity, no authentication, some impact on confidentiality and integrity, an exploit in existence and all target configurations exposed. That last factor matters most. It means a store does not need an unusual setup or an optional submodule switched on to be at risk; any site running an affected Commerce Core version is.

Commerce Core provides the cart, checkout, orders, products and payment integrations for Drupal, and it also serves decoupled storefronts through APIs, which widens the routes a scanner can find. The advisory does not say which routes or fields are unprotected, which is normal for Drupal while sites are still updating.

Fixed versions

• Commerce Core 3.x: update to 3.3.13. Every release from 3.0.0 up to 3.3.12 is affected.
• Commerce Core 2.x (the 8.x-2.x branch): update to 8.x-2.41. Every earlier release is affected.

The flaw was reported by Dan Puccetti, Marcus Johansson and Robert Snyder and fixed by the Commerce maintainers, among them Ryan Szrama and Jonathan Sacksick, with members of the Drupal Security Team. A Composer update of drupal/commerce brings in the fixed release; a site pinned to an older minor version needs the constraint widened first.

Checking the order book

The advisory's own advice goes beyond patching: "Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited." The words "financially impact the vendor" point at order and price data, so the places to look are orders whose totals, adjustments or line items do not match the catalogue prices and promotions in force when they were placed, orders that changed state without a matching payment, and unusual edits made through the API or by anonymous sessions in the web server logs since the start of October. A shop that takes payment through an external gateway can reconcile gateway settlements against Drupal's order totals, which is the quickest way to find a discount that should not exist.

Agencies that host several Commerce sites for clients should treat this as a fleet update, since the advisory gives no configuration that is safe. Our B2B ecommerce platform software category lists ten products, and we list 282 ecommerce development companies, many of which build on Drupal.

Company profile on TrustList: Centarro

Related on TrustList:

• Drupal fixes critical Field UI flaw with a no-login path via add-ons
• Adobe fixes CVSS 10 flaws in ColdFusion and Experience Manager

Sources

• Drupal.org: Commerce Core, Highly critical, Access bypass, SA-CONTRIB-2026-254, 28 October 2026